CVE-2026-0895
Insecure Deserialization in TYPO3 FileSpool Extension Bypasses Patch
Publication date: 2026-01-20
Last updated on: 2026-01-20
Assigner: TYPO3
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cpsit | typo3_mailqueue | 0.5.0 |
| cpsit | typo3_mailqueue | 0.4.2 |
| cpsit | typo3_mailqueue | 0.5.1 |
| cpsit | typo3_mailqueue | 0.4.3 |
| typo3 | typo3 | 12.4.41 |
| typo3 | typo3 | 13.4.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an insecure deserialization issue in the TYPO3 Mailqueue extension. The extension extends TYPO3's FileSpool component, which was previously vulnerable to unsafe deserialization. Even after the TYPO3 core was patched, the extension overwrites the fix by including the vulnerable code extracted from the core. This allows attackers to exploit unsafe deserialization of messages from files, potentially leading to object injection or execution of malicious code. The vulnerability arises because the extension uses PHP's native unserialize() function unsafely, which was replaced in the fix by a polymorphic deserializer that restricts allowed classes during deserialization and adds exception handling to prevent exploitation. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access and low privileges to exploit unsafe deserialization in the mailqueue system. This could lead to security risks such as object injection or execution of malicious code within the TYPO3 environment. Although the attack requires local access and partial attack type, it can compromise the integrity of the system and potentially escalate privileges or disrupt normal operations. The CVSS score indicates a medium severity with high scope and security impact, emphasizing the importance of applying the fix. [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Mailqueue extension to versions 0.5.1 or 0.4.3 or later, which include the security fix. These updated versions are available via the TYPO3 extension manager, Packagist, and the TYPO3 extensions repository. The fix involves replacing unsafe unserialize() calls with a polymorphic deserializer that restricts allowed classes during deserialization and adds exception handling to prevent exploitation. Users are strongly advised to update promptly to these fixed versions to avoid insecure deserialization risks. [2]