Extension Typo3 Fluid Form By Coding Ms
Monthly
Unauthenticated information disclosure in the coding.ms 'typo3_fluid_form' extension for TYPO3 lets remote attackers retrieve files other visitors uploaded through forms, because the download link depends on a predictable token and the file name in the request is not verified in a guess-resistant way. Only sites that run the extension and use its file-upload-via-form workflow are exposed, and only files that already exist can be read; the vendor rates the issue CVSS 4.0 base 6.3, while our independent assessment scores it CVSS 3.1 6.5-equivalent at AV:N/AC:H/PR:N/UI:N with low confidentiality impact and no integrity or availability effect. A second exposure path exists: the token is rendered in plain text in the text/plain body of the notification email, so anyone who can read that message (forwarding, misdelivery, mailbox compromise, mailing-list archiving) obtains the token directly. No public exploit code or confirmed active exploitation was identified in the provided data.
Stored HTML injection in the TYPO3 Fluid Form extension (typo3_fluid-form_by_coding.ms) lets unauthenticated remote attackers submit form values that are rendered unescaped in the HTML summary email sent to the site operator. The issue is medium severity (CVSS 5.3, CWE-79) and requires the extension's HTML summary-email notification feature to be enabled with a publicly reachable form; impact is limited to the recipient opening the email, where active scripting is typically suppressed, and no public exploit identified at time of analysis.
Unauthenticated information disclosure in the coding.ms 'typo3_fluid_form' extension for TYPO3 lets remote attackers retrieve files other visitors uploaded through forms, because the download link depends on a predictable token and the file name in the request is not verified in a guess-resistant way. Only sites that run the extension and use its file-upload-via-form workflow are exposed, and only files that already exist can be read; the vendor rates the issue CVSS 4.0 base 6.3, while our independent assessment scores it CVSS 3.1 6.5-equivalent at AV:N/AC:H/PR:N/UI:N with low confidentiality impact and no integrity or availability effect. A second exposure path exists: the token is rendered in plain text in the text/plain body of the notification email, so anyone who can read that message (forwarding, misdelivery, mailbox compromise, mailing-list archiving) obtains the token directly. No public exploit code or confirmed active exploitation was identified in the provided data.
Stored HTML injection in the TYPO3 Fluid Form extension (typo3_fluid-form_by_coding.ms) lets unauthenticated remote attackers submit form values that are rendered unescaped in the HTML summary email sent to the site operator. The issue is medium severity (CVSS 5.3, CWE-79) and requires the extension's HTML summary-email notification feature to be enabled with a publicly reachable form; impact is limited to the recipient opening the email, where active scripting is typically suppressed, and no public exploit identified at time of analysis.