CVE-2026-112240: medium-severity vulnerability in TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.4%
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "TYPO3 Fluid-Form by coding.ms"Related CVEs — TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
In the same product, most dangerous first.