The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
Description
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | cpsit/typo3-mailqueue | < 0.4.5, >= 0.5.0, < 0.5.2 | 0.4.5, 0.5.2 |
References
- https://github.com/CPS-IT/mailqueue/security/advisories/GHSA-2pm6-9fhx-vvg3
- https://nvd.nist.gov/vuln/detail/CVE-2026-1323
- https://github.com/CPS-IT/mailqueue/commit/0f7a1376bbbd8c7658030d02e51c10a85b1dfdf7
- https://github.com/CPS-IT/mailqueue/commit/600c7dba99f8eea5f2505b848ee3dd4713440741
- https://github.com/CPS-IT/mailqueue
- https://typo3.org/security/advisory/typo3-ext-sa-2026-005
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Composer
- Package
cpsit/typo3-mailqueue- Disclosed
- 18.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2pm6-9fhx-vvg3 - CC BY 4.0
Vulnerability history: cpsit/typo3-mailqueue
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 01.2026 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2026: 2
-
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.