CVE-2026-15305 is a medium severity vulnerability in TYPO3 CMS (versions 14.2.0-14.3.4) involving insufficient type distinction (CWE-351). The issue arises because the MimeTypeValidator, responsible for enforcing allowed MIME types on FileUpload or ImageUpload form elements, is registered during form building before concrete form definition properties are applied. As a result, the validator is never added to the processing pipeline server-side, allowing users to upload files with arbitrary MIME types despite configured restrictions.

Attackers can bypass MIME type restrictions on file uploads, potentially allowing upload of unauthorized or malicious file types. This could lead to unauthorized file storage or further exploitation depending on the application context. The CVSS 4.0 score is 6.3 (medium), indicating a moderate impact with network attack vector, low attack complexity, no privileges or user interaction required, but limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor TYPO3 vendor advisories for updates. Until a fix is available, consider implementing additional server-side MIME type validation or restricting file upload functionality as a temporary measure.