CVE-2023-26091: 
PHP vulnerability analysis and mitigation

The CVE-2023-26091 vulnerability affects the Forms Export (frp_form_answers) extension for TYPO3 CMS versions 3.1.1 and below, as well as versions 4.0.0 - 4.0.1. This security flaw was discovered and disclosed on February 21, 2023, involving a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts via saved emails (TYPO3 Advisory).

The vulnerability is classified as a Persisted Cross-Site Scripting issue with a high severity rating. The CVSS score for this vulnerability is based on the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:F/RL:O/RC:C, indicating a network-accessible vector with low attack complexity and no required privileges. The vulnerability is tracked as CWE-79, which is a common identifier for Cross-Site Scripting flaws (TYPO3 Advisory).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browser sessions when viewing affected email content. This can lead to compromised confidentiality through data theft, integrity issues through content manipulation, and potential availability impacts (TYPO3 Advisory).

The vulnerability has been patched in versions 3.1.2 and 4.0.2 of the Forms Export extension. Users are strongly advised to update to these versions as soon as possible. The updated versions can be obtained through the TYPO3 extension manager, packagist, or directly downloaded from the TYPO3 extension repository (TYPO3 Advisory).