[ CVE-2026-112240 · Published 20 Oct 2026 ]

Vulnerability in TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"

CVSS 6.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund19 Oct 2026WID-SEC-2026-4053

TYPO3 Extensions: Multiple vulnerabilities Translated from German
CVE-2026-113468CVE-2026-112239CVE-2026-112068+12 more CVEs

[ References ]References

typo3.org/security/advisory/typo3-ext-sa-2026-033

[ Facts ]Key facts

CVE: CVE-2026-112240
EUVD: EUVD-2026-104869
Published: 20 Oct 2026, 10:17 UTC
Updated: 20 Oct 2026, 19:28 UTC
NVD status: Deferred
CVSS 4.0: 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scored by f4fb688c-4412-4426-b4b8-421ecf27b14a
EPSS: 0.39% chance of exploitation in 30 days · higher than 32% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-338 CWE-639

[ Affected ]Affected products

TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"6.0.0 – < 6.0.6, < 5.0.10

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

TYPO3 Extensions: Multiple vulnerabilities Translated from German

[ References ]References