CVE-2026-113442: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"

This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the TYPO3 Fluid-Form extension by coding.ms. Specifically, user-supplied input is embedded into HTML summary emails without escaping, enabling an unauthenticated attacker to inject HTML content into these emails. The flaw affects two version ranges of the extension: versions from 0 up to but not including 5.0.10, and versions from 6.0.0 up to but not including 6.0.6. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity, with no impact on confidentiality or availability.

An unauthenticated attacker can inject arbitrary HTML into summary emails generated by the TYPO3 Fluid-Form extension. This could lead to phishing or social engineering attacks against recipients of these emails. The impact is limited to the integrity of the email content and does not affect confidentiality or availability of the system.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected extension versions or applying input sanitization workarounds if feasible.