HTML Injection Vulnerability in TYPO3 Extensions by TYPO3
CVE-2026-113442

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "typo3 Fluid-form By Coding.ms"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113442?

This vulnerability allows an unauthenticated attacker to inject malicious HTML content into summary emails generated by TYPO3. When a visitor enters input, the values are directly incorporated into the email without proper escaping. This can lead to unauthorized content viewing and phishing attacks, as recipients may be exposed to harmful scripts or misleading information embedded within the email. Protecting against this vulnerability requires ensuring proper input validation and sanitation to prevent such attacks.

Affected Version(s)

Extension "TYPO3 Fluid-Form by coding.ms" 6.0.0 < 6.0.6

Extension "TYPO3 Fluid-Form by coding.ms" 0 < 5.0.10

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-033
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thomas Deuling
Thomas Deuling
.