CyberRota Analysis
AI-GeneratedTYPO3 CMS versions 14.2.0 to 14.3.4 are vulnerable due to a flaw that allows users to upload files with arbitrary MIME types, as the server-side restriction on allowed MIME types is not enforced correctly. This can lead to potential security risks, such as the upload of malicious files that could compromise the system. Organizations using affected TYPO3 versions should prioritize addressing this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.