PT-2026-25877 · Typo3 · Extension "Mailqueue"

Elias Häußler · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-1323

NVD

CVSS v4.0

5.2

5.2

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3 CONF VARS']['MAIL']['transport spool filepath'].

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-1323

Affected Products

Extension "Mailqueue"

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-1323 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2026-005 · Vendor Advisory