Home

Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

PUBLISHED Reserved 2026-01-22 | Published 2026-03-17 | Updated 2026-03-17 | Assigner TYPO3




MEDIUM: 5.2CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status
unaffected

Any version before 0.4.5
affected

0.5.0 (semver) before 0.5.2
affected

Credits

Elias Häußler reporter

Elias Häußler remediation developer

References

typo3.org/security/advisory/typo3-ext-sa-2026-005 vendor-advisory

cve.org (CVE-2026-1323)

nvd.nist.gov (CVE-2026-1323)

Download JSON