CVE-2026-1323
Insecure Deserialization in extension "Mailqueue" (mailqueue)
- State
- Published
- Severity
- 5.2 Medium
- Published
- Mar 17, 2026
- Updated
- Mar 17, 2026
- Reserved
- Jan 22, 2026
Description
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.2 Medium | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H | TYPO3 |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
Extension "Mailqueue"TYPO3 |
|
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-005vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.