CVE-2026-112240
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"Applications & CMS
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.0.6Extension "TYPO3 Fluid-Form by coding.ms"CVE List
- 5.0.10Extension "TYPO3 Fluid-Form by coding.ms"CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
Text from CVE List
Affected versions 2
- Extension "TYPO3 Fluid-Form by coding.ms"affected: 6.0.0 before 6.0.6CVE List
- Extension "TYPO3 Fluid-Form by coding.ms"affected: all versions before 5.0.10CVE List