GHSA-p8pr-442q-qf8g
Duplicate Advisory: TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework
Summary
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mfqj-cqv3-h7xw. This link is maintained to preserve external references. ## Original Description Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.5.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Packagist | typo3/cms-form | — | 14.3.5 |
Remediation: Upgrade to 14.3.5 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.