TYPO3 Fluid Form EUVD-2026-104868

Requires the site to run the 'typo3_fluid-form_by_coding.ms' TYPO3 extension with its HTML summary-email notification feature enabled, and a publicly reachable form whose submitted field values are included in that email. Exploitation is unauthenticated and remote against the form, but is LIMITED by passive user interaction (UI:P): the injected HTML only affects the email recipient when they open the summary message, and impact is further constrained because the payload executes in an email client (which typically neutralizes active scripting) rather than in a live web session. The impacted party is the notification recipient (operator), not general site visitors.

This is a medium-severity (CVSS 5.3) stored HTML injection (CWE-79) in a third-party TYPO3 extension. The provided CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N) signals a network-reachable, unauthenticated, low-complexity flaw whose only impact is limited integrity (VI:L) on the vulnerable system, with no confidentiality or availability impact and no scope/subsequent-system change. Crucially, exploitation is gated on passive user interaction (UI:P): the injected HTML only takes effect when the email recipient opens the summary message. There is no EPSS score, no CISA KEV listing, and no public exploit referenced - only a single vendor advisory (TYPO3-EXT-SA-2026-033) - so this is no public exploit identified at time of analysis. The practical risk is modest: the payload lands in an HTML email rather than a live web session, and most modern mail clients strip active scripting, which constrains this closer to HTML/phishing content injection than full browser XSS. Note also that the injection target is the email recipient (typically a site operator/form-notification receiver), not arbitrary site visitors. Overall this is a genuine but low-priority issue, not a high-urgency threat.

An attacker submits the public-facing Fluid form with HTML markup embedded in a field value. The application builds an HTML summary email from those values without escaping them, so when the notification recipient (e.g., a site administrator) opens the email, the attacker's markup renders - enabling spoofed content, misleading links, or phishing lures inside a trusted-looking message. No public exploit code is referenced, and success depends on the recipient opening the crafted email (UI:P).