{"action":"Upgrade typo3/cms-form to 14.3.5 or later.","affected":[{"fixed":"14.3.5","introduced":"14.2.0"}],"component":"typo3/cms-form","cve_ids":["CVE-2026-15305"],"ecosystem":"Packagist","epss":0.00254,"exploited":false,"fixed_versions":["14.3.5"],"ghsa_id":"GHSA-mfqj-cqv3-h7xw","id":"tcs_01M5KF5FR31AVCAHTA69TDM9NE","modified_at":"2026-08-31T20:25:45.219133Z","published_at":"2026-08-31T19:53:59Z","references":["https://osv.dev/vulnerability/GHSA-mfqj-cqv3-h7xw","https://github.com/TYPO3/typo3/security/advisories/GHSA-mfqj-cqv3-h7xw","https://nvd.nist.gov/vuln/detail/CVE-2026-15305","https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a","https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml","https://github.com/TYPO3/typo3","https://news.typo3.com/security/advisory/typo3-core-sa-2026-020","https://typo3.org/security/advisory/typo3-core-sa-2026-020"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-mfqj-cqv3-h7xw","url":"https://osv.dev/vulnerability/GHSA-mfqj-cqv3-h7xw"},{"source":"nvd","source_id":"CVE-2026-15305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15305"}],"summary":"TYPO3 CMS - Unrestricted File Upload in Form Framework"}