CVE-2026-113442 — Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

CVE-2026-113442

Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) PUBLISHED

Description (CNA)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "TYPO3 Fluid-Form by coding.ms"	affected 6.0.0 before 6.0.6; affected 0 before 5.0.10

CWE

CWE-79

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-033

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.