CVE-2026-112240 Details
Description
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
A vulnerability in the TYPO3 Fluid-Form extension, affecting versions 5.0.9 and below, as well as 6.0.0 to 6.0.5, allows unauthenticated attackers to access files uploaded by other visitors. This issue arises because the download link for these files relied on a predictable token, and the file name in the request was not adequately protected against guessing. Additionally, the token was exposed in plain text in the notification email's text version.
Users are advised to update to version 5.0.10 or 6.0.6, available through the TYPO3 extension manager, Packagist, or the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-033 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | TYPO3 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Fluid-Form | <= 5.0.9 (semver) >= 6.0.0, <= 6.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |