The vulnerability allows uploading of files with arbitrary MIME types to form elements that normally enforce restrictions through the Form Framework. Because the server‑side MIME type validator is registered during form building before concrete form definition properties are applied, the validator never participates in the validation pipeline, resulting in unrestricted file uploads. The weakness is identified as CWE‑351, indicating a failure to enforce security controls during processing.

TYPO3 CMS versions from 14.2.0 through 14.3.4 are affected. The issue is present in any installation that uses the FileUpload or ImageUpload elements with a configured allowedMimeTypes list, regardless of the specific MIME types listed.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector would involve submitting a file via a publicly reachable web form that uses the vulnerable FileUpload or ImageUpload elements. This inference is drawn from the requirement that the flaw be exercised through a form submission; further exploitation details are not provided in the CVE description.