CVE-2026-113442: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Published Oct 20, 2026
·Updated
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
Affected Software
1 affected component
coding.ms TYPO3 Fluid-Form (fluid_form)
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Sites using the coding.ms TYPO3 Fluid-Form extension are exposed where visitor-supplied form values are included in HTML summary emails viewed by recipients.
2
What does an attacker need to exploit it?
An attacker only needs to submit crafted values through a form. No authentication is required.
3
What is the impact of successful exploitation?
The attacker can inject HTML into the summary email received by the form recipient. The provided information does not establish execution of JavaScript or impact beyond the rendered email content.