TYPO3 Fluid Form CVE-2026-112240

Exploitation requires that the target TYPO3 site runs the coding.ms 'typo3_fluid_form' extension AND uses its file-upload-via-form feature, with at least one file already uploaded by another visitor to retrieve. The attacker must predict or guess both the download token and the uploaded file's name; alternatively, anyone with access to the plain-text body of the generated notification email can read the token directly. Limiting factors: the attack succeeds only against files that exist and whose token/name can be derived (reflected in CVSS AT:P), impact is limited to reading others' uploaded files (low confidentiality, no modification or DoS), and sites not using this extension's upload workflow are unaffected.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 6.3) rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) shows a network, unauthenticated vector with low complexity but an attack requirement (AT:P) - meaning exploitation depends on conditions outside the attacker's control, consistent with needing to predict/guess tokens and file names and only succeeding against files that actually exist. Impact is confined to low confidentiality (VC:L); there is no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so this reflects no public exploit identified at time of analysis. The combination of only-low confidentiality impact, a probabilistic attack requirement, and the fact that the affected software is a single third-party TYPO3 extension (not a core product) means real-world risk is modest and most likely opportunistic/targeted rather than mass-exploitable. Note a minor signal tension: AC:L advertises easy exploitation, but AT:P and the description's emphasis on token/filename guessing indicate practical exploitation is not fully deterministic - treat 'low complexity' with that caveat.

A visitor submits a web form that uploads a file via the coding.ms 'typo3_fluid_form' TYPO3 extension; the extension generates a download link protected only by a predictable token, and the filename in the request is not robustly verified. An unauthenticated attacker predicts or guesses the token and file name (or reads the token from the plain-text version of the notification email) and retrieves files uploaded by other visitors. No public exploit code is identified at time of analysis.