How severe is CVE-2026-15305?

CVE-2026-15305 has a CVSS 4.0 base score of 6.3, rated medium severity.

Is CVE-2026-15305 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-15305?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-15305 published?

CVE-2026-15305 was published on 2026-07-14 and last updated on 2026-07-15.

CVE-2026-15305

CVE-2026-15305 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-351.

Key facts

Severity: Medium (CVSS 4.0 base score 6.3)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-351
Published: 2026-07-14
Last modified: 2026-07-15

Description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Frequently asked questions

What is CVE-2026-15305?: Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
How severe is CVE-2026-15305?: CVE-2026-15305 has a CVSS 4.0 base score of 6.3, rated medium severity.
Is CVE-2026-15305 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-15305?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-15305 published?: CVE-2026-15305 was published on 2026-07-14 and last updated on 2026-07-15.

References

Other CWE-351 vulnerabilities

CVE-2025-30510 — Critical (CVSS 9.8): An attacker can upload an arbitrary file instead of a plant image.
CVE-2025-54413 — High (CVSS 8.7): skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below…
CVE-2025-54412 — High (CVSS 8.7): skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below…
CVE-2025-65960 — Medium (CVSS 6.6): Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users…
CVE-2024-4769 — Medium (CVSS 5.9): When importing resources using Web Workers, error messages would distinguish the difference between…
CVE-2026-41341 — Medium (CVSS 5.4): OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group…

Browse all CWE-351 vulnerabilities →