CVE-2026-1323 PUBLISHED

Insecure Deserialization in extension "Mailqueue" (mailqueue)

Assigner: TYPO3
Reserved: 22.01.2026 Published: 17.03.2026 Updated: 17.03.2026

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
CVSS Score: 5.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	None	Confidentiality	High
Attack Complexity	Low	Integrity	Low	Integrity	High
Attack Requirements	Present	Availability	None	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	TYPO3
Product	Extension "Mailqueue"
Versions	Default: unaffected affected from 0 to 0.4.5 (excl.) affected from 0.5.0 to 0.5.2 (excl.)

Credits

Elias Häußler reporter
Elias Häußler remediation developer

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-005

Problem Types

CWE-502 Deserialization of Untrusted Data CWE