CVE-2026-15305 is a medium severity vulnerability in TYPO3 CMS affecting versions 14.2.0 up to but not including 14.3.5. The issue arises from insufficient type distinction (CWE-351) in the file upload validation process. Specifically, the MimeTypeValidator intended to enforce allowed MIME types on FileUpload or ImageUpload form elements is registered prematurely during form construction, before the concrete form definitions are applied. This leads to the validator never being added to the server-side processing pipeline, allowing users to bypass MIME type restrictions and upload files with arbitrary MIME types.

The vulnerability allows attackers or users to upload files with arbitrary MIME types to TYPO3 CMS forms that are configured to restrict uploads by MIME type. This could lead to unauthorized file uploads that may bypass intended security controls. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, but limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, administrators should consider additional manual validation or restrictions on file uploads to mitigate the risk.