GHSA-p8pr-442q-qf8g: Duplicate Advisory TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted Vulnerability

MODERATE
Share
CWE-351
Published
Advisory Summary

GHSA-p8pr-442q-qf8g is a MODERATE typo3-core-sa-2026-020: typo3 cms - unrestricted vulnerability (CWE-351: Insufficient Type Distinction) affecting Duplicate Advisory libraries in the Packagist ecosystem. The issue involves typo3-core-sa-2026-020: typo3 cms - unrestricted file upload in form framework. Remediation is available by upgrading affected packages to version 14.3.5.

GHSA-p8pr-442q-qf8g at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-p8pr-442q-qf8g
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-351: Insufficient Type Distinction
Affected Product Duplicate Advisory
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix GHSA-p8pr-442q-qf8g

To remediate this vulnerability, upgrade all affected Duplicate Advisory dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

typo3/cms-form fixed: 14.3.5 
Upgrade typo3/cms-form to 14.3.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for typo3/cms-form

How to Check if You Are Affected

To determine whether your application is affected by GHSA-p8pr-442q-qf8g, inspect your project dependencies for Duplicate Advisory:

inspect dependencies for typo3/cms-form

Analyze the terminal output to locate any version of Duplicate Advisory in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 14.3.5), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-351: Insufficient Type Distinction, where the product does not properly distinguish between different types of elements in a way that leads to insecure behavior. In Duplicate Advisory, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mfqj-cqv3-h7xw. This link is maintained to preserve external references. ## Original Description Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.5.

GHSA-p8pr-442q-qf8g Affected Duplicate Advisory Versions

1 component(s)
Fixed Versions:
14.3.5
Product / Package Ecosystem Affected Versions Fixed Version
typo3/cms-form
 Packagist
≥ 14.2.0
< 14.3.5
14.3.5

References

NVD — GHSA-p8pr-442q-qf8g NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15305
Security Fix Commit FIX COMMIT
https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
Security Fix Commit FIX COMMIT
https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
Duplicate Advisory Source Repository REPOSITORY
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml
Duplicate Advisory Security Information SECURITY
https://news.typo3.com/security/advisory/typo3-core-sa-2026-020
Duplicate Advisory Security Information SECURITY
https://typo3.org/security/advisory/typo3-core-sa-2026-020

Frequently Asked Questions

What is GHSA-p8pr-442q-qf8g?
GHSA-p8pr-442q-qf8g is a security vulnerability in Duplicate Advisory involving TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework under CWE-351: Insufficient Type Distinction.
Which Duplicate Advisory versions are affected?
Affected versions include releases prior to 14.3.5 across affected packages: typo3/cms-form.
What version fixes GHSA-p8pr-442q-qf8g?
Upgrading to 14.3.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is typo3/cms-form affected?
Yes, typo3/cms-form is affected in releases prior to 14.3.5. Upgrade your dependency to 14.3.5 or later.
What CWE is associated with GHSA-p8pr-442q-qf8g?
GHSA-p8pr-442q-qf8g is classified under CWE-351: Insufficient Type Distinction (The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.).
How can I check Packagist dependencies for GHSA-p8pr-442q-qf8g?
Run the dependency tree command: 'inspect dependencies for typo3/cms-form'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p8pr-442q-qf8g",
  "modified" : "2026-08-31T19:53:50Z",
  "published" : "2026-07-14T15:32:15Z",
  "withdrawn" : "2026-08-31T19:53:50Z",
  "aliases" : [ ],
  "summary" : "Duplicate Advisory: TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework",
  "details" : "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-mfqj-cqv3-h7xw. This link is maintained to preserve external references.\n\n## Original Description\n\nUsers were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.5.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "typo3/cms-form"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "14.2.0"
      }, {
        "fixed" : "14.3.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-15305"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://news.typo3.com/security/advisory/typo3-core-sa-2026-020"
  }, {
    "type" : "WEB",
    "url" : "https://typo3.org/security/advisory/typo3-core-sa-2026-020"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-351" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-31T19:53:50Z",
    "nvd_published_at" : "2026-07-14T13:18:16Z"
  }
}