CVE-2026-112240
Received Received - Intake

Predictable File Access in Web Application

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112240
EUVD
EUVD-2026-104869

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "TYPO3 Fluid-Form by coding.ms" 6.0.0
TYPO3 Extension "TYPO3 Fluid-Form by coding.ms" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a TYPO3 extension where file download links used predictable tokens, allowing attackers to guess and access files uploaded by other users without authentication. Additionally, file names were not properly verified, enabling guessing attacks. The token was also exposed in plain text in email notifications.

Impact Analysis

An unauthenticated attacker could access sensitive files uploaded by other users through the form. This could lead to unauthorized data exposure, privacy breaches, or leakage of confidential information. The plain text token in emails also risks further exploitation if intercepted.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the TYPO3 Fluid-Form extension to versions 5.0.10 or 6.0.6 or later to address the vulnerabilities. Check for unauthorized file access and review email notifications for suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart