CVE-2026-112240

The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...