Description
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "TYPO3 Fluid-Form by coding.ms" | 6.0.0 – < 6.0.6, < 5.0.10 | 6.0.6 |
Advisories 1
- WID-SEC-2026-4053 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-033 vendor-advisory