CVE-2026-15305

Packagist/typo3/cms-form CVE-2026-15305: medium

TYPO3 CMS - Unrestricted File Upload in Form Framework

Action: Upgrade typo3/cms-form to 14.3.5 or later.

composer require typo3/cms-form:14.3.5

Affected

Fixed versions

Sources

• osv: GHSA-mfqj-cqv3-h7xw
• https://github.com/TYPO3/typo3/security/advisories/GHSA-mfqj-cqv3-h7xw
• https://nvd.nist.gov/vuln/detail/CVE-2026-15305
• https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
• https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml
• https://github.com/TYPO3/typo3
• https://news.typo3.com/security/advisory/typo3-core-sa-2026-020
• https://typo3.org/security/advisory/typo3-core-sa-2026-020

CVE-2026-15305 · published 2026-08-31T19:53:59Z · modified 2026-08-31T20:25:45.219133Z · JSON