CVE-2026-112240: falha de média gravidade em TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TYPO3 · Extension "TYPO3 Fluid-Form by coding.ms"CVEs relacionadas — TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
No mesmo produto, das mais perigosas para as menos.