CVE-2026-112240: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Published Oct 20, 2026
·Updated
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
Affected Software
1 affected component
coding.ms TYPO3 Fluid-Form (fluid_form)
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploiting this issue require an authenticated TYPO3 account?
No. The issue can be exploited by an unauthenticated attacker.
2
What data could be exposed if the issue is exploited?
An attacker could access files uploaded through the form by other visitors.
3
Are notification emails relevant to exposure?
Yes. The download token was included in plain text in the text version of the notification email, creating an additional way for the token to be disclosed.