CVE-2026-15305: 
PHP Analyse et atténuation des vulnérabilités

CVE-2026-15305 is a MIME type validation bypass vulnerability in TYPO3 CMS affecting the typo3/cms-form package. It allows unauthenticated users to upload files with arbitrary MIME types to forms that use FileUpload or ImageUpload elements with allowedMimeTypes configured, because the server-side restriction is never actually enforced. The vulnerability affects TYPO3 CMS versions 14.2.0 through 14.3.4 (fixed in 14.3.5). It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, TYPO3 Advisory). The CVE was published on July 14, 2026.

The root cause is a timing issue during form building, classified as CWE-351 (Insufficient Type Distinction). FileUpload::initializeFormElement() attempted to register the MimeTypeValidator based on the allowedMimeTypes property, but this method is called from AbstractSection::createElement() before the concrete form definition properties are applied via the second setOptions() call in ArrayFormFactory::addNestedRenderable(). Because the prototype type definition does not contain allowedMimeTypes, the property was always empty at registration time, so the validator was never added to the ProcessingRule processing pipeline. The only remaining enforcement was the client-side HTML accept attribute, which can be trivially bypassed by modifying the file picker in a browser or using tools like curl. The fix moves MimeTypeValidator registration to PropertyMappingConfiguration::adjustPropertyMappingForFileUploadsAtRuntime(), where form definition properties are fully resolved at runtime (TYPO3 Commit, GitHub Advisory).

Successful exploitation allows any user who can submit a TYPO3 form with a FileUpload or ImageUpload element to upload files of any MIME type, bypassing the administrator-configured allowedMimeTypes restriction. This can result in unauthorized file types (e.g., PHP scripts, executables, or other malicious content) being stored in the TYPO3 FAL (File Abstraction Layer) storage, potentially enabling further attacks such as web shell deployment if the upload directory is web-accessible. The integrity and availability of the vulnerable system are impacted (low severity each), while confidentiality is not directly affected (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability does not require authentication or user interaction, but does require that a TYPO3 form with a FileUpload or ImageUpload element and allowedMimeTypes configured be publicly accessible. The EPSS score is approximately 0.174% (7th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a publicly accessible TYPO3 CMS instance running versions 14.2.0–14.3.4 that exposes a frontend form containing a FileUpload or ImageUpload element with allowedMimeTypes configured (e.g., only application/pdf allowed).
2. Inspect the form: Load the form page in a browser and inspect the HTML to confirm the presence of a file upload field with a restrictive accept attribute (e.g., accept="application/pdf").
3. Bypass client-side restriction: Use a tool such as curl, Burp Suite, or browser developer tools to craft a multipart form submission that includes a file with a disallowed MIME type (e.g., a PHP script with Content-Type: application/x-php) while omitting or overriding the accept constraint.
4. Submit the crafted request: POST the multipart request directly to the form's action endpoint. Because the server-side MimeTypeValidator was never registered in the processing pipeline, the upload passes validation and the form finishers execute normally.
5. Confirm upload: Verify that the file was accepted and stored in the TYPO3 FAL storage (e.g., 1:/user_upload/) by observing a successful form submission response or checking for the file in the upload directory if accessible (TYPO3 Commit).

• Network: Multipart HTTP POST requests to TYPO3 frontend form endpoints containing file uploads with MIME types inconsistent with the form's configured allowedMimeTypes; file upload requests where the Content-Type of the uploaded part differs from the HTML accept attribute value.
• File System: Unexpected file types (e.g., .php, .phtml, .exe, .sh) present in TYPO3 FAL upload directories (default: fileadmin/user_upload/ or form-specific subdirectories such as form_<hash>/); files with mismatched extensions and actual content types in upload folders.
• Logs: TYPO3 access logs showing successful form submissions (HTTP 200) where the uploaded file's MIME type does not match the configured allowedMimeTypes; absence of validation error responses for uploads that should have been rejected on affected versions.

TYPO3 has released version 14.3.5 of typo3/cms-form which fixes this vulnerability by moving MimeTypeValidator registration to runtime in PropertyMappingConfiguration::adjustPropertyMappingForFileUploadsAtRuntime(). Administrators should upgrade to 14.3.5 or later immediately (TYPO3 Advisory). As a temporary workaround prior to patching, implement additional server-side file validation outside the TYPO3 form framework (e.g., via a custom finisher or middleware), or disable public-facing forms with FileUpload/ImageUpload elements until the patch is applied.