Media

TYPO3 CMS - Unrestricted File Upload in Form Framework

Publicada: 31.08.2026
Actualizado: 11.10.2026 10:22

Problem

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

Solution

Update to TYPO3 version 14.3.5 LTS that fixes the problem described.

Credits

Thanks to Sébastien Convers for reporting this issue, and to Josua Vogel and Oliver Hader for fixing it.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	typo3/cms-form	>= 14.2.0, < 14.3.5	14.3.5

Referencias

Puntuación CVSS -

Vector CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Debilidad (CWE): CWE-351
Plataforma: Composer
Paquete: typo3/cms-form
Publicada: 31.08.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-mfqj-cqv3-h7xw - CC BY 4.0

Historial de vulnerabilidades: typo3/cms-form

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 8
Primera → última: 03.2021 08.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 5
Media 3

Divulgaciones por año

2021: 3
2022: 0
2023: 0
2024: 0
2025: 1
2026: 4

31.08.2026

TYPO3 CMS - Unrestricted File Upload in Form Framework esta entrada

Media CVE-2026-15305 >= 14.2.0, < 14.3.5 14.3.5
12.06.2026

TYPO3 CMS has Broken Access Control in its Form Framework

Alta CVE-2026-11607 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
12.06.2026

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

Alta CVE-2026-49741 >= 14.0.0, < 14.3.3 14.3.3
12.06.2026

TYPO3 CMS has Broken Access Control in its Form Framework

Alta CVE-2026-47346 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
14.01.2025

TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery

Media · 5.4 CVE-2024-55922 >= 10.0.0, < 10.4.48, >= 11.0.0, < 11.5.42, >= 12.0.0, < 12.4.25, >= 13.0.0, < 13.4.3 10.4.48, 11.5.42, 12.4.25, 13.4.3
23.03.2021

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

Media · 5.4 CVE-2021-21358 >= 10.2.0, < 10.4.14, >= 11.0.0, < 11.1.1 10.4.14, 11.1.1
23.03.2021

Broken Access Control in Form Framework

Alta · 8.3 CVE-2021-21357 >= 8.0.0, < 8.7.40, >= 9.0.0, < 9.5.25, >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1 8.7.40, 9.5.25, 10.4.14, 11.1.1
23.03.2021

Unrestricted File Upload in Form Framework

Alta · 8.6 CVE-2021-21355 >= 8.0.0, < 8.7.40, >= 9.0.0, < 9.5.25, >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1 8.7.40, 9.5.25, 10.4.14, 11.1.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación