The flaw allows an attacker to obtain files uploaded by other users through the form by using a predictable download token and an unvalidated file name. This results in unauthorized disclosure of possibly sensitive data without needing any authentication. The weakness originates from an insecure token generation and a missing validation of the file name, as described by CWE-338 and CWE-639.

TYPO3 systems that have the public TYPO3 Fluid-Form by coding.ms extension installed are affected. No specific version numbers are provided, so any deployed copy of the extension should be assessed.

The CVSS score of 6.3 indicates significant risk, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. A likely attack path would involve a web request to the download endpoint with a guessed token and file name, which succeeds because the token is predictable and the name is not properly verified. Overall, this enables an unauthenticated attacker to read files uploaded by other visitors.