CVE-2026-113442 Details
Description
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
A cross-site scripting vulnerability has been identified in the TYPO3 Fluid-Form extension, versions 5.0.9 and below, as well as 6.0.0 to 6.0.5. This vulnerability allows an unauthenticated attacker to inject HTML into summary emails, which is then displayed to the recipient. The issue arises because values entered by users were not properly escaped before being included in the email.
Users are advised to update to version 5.0.10 or 6.0.6, available through the TYPO3 Extension Manager, Packagist, or the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-033 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Fluid-Form | <= 5.0.9 (semver) >= 6.0.0, <= 6.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |