CVE-2026-1323 json
Insecure Deserialization in extension "Mailqueue" (mailqueue)
published 2026-03-17 7 mo ago modified 2026-06-17 4 mo ago also GHSA-2pm6-9fhx-vvg3 , EUVD-2026-12548
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
Patch / fix
- packagist cpsit/typo3-mailqueue 0.4.5, 0.5.2
- TYPO3 Extension "Mailqueue" 0.4.5, 0.5.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cpsit/typo3-mailqueue | <0.4.5 >=0.5.0, <0.5.2 |
0.4.5 0.5.2 |
Affected products
- TYPO3 Extension "Mailqueue"
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/CPS-IT/mailqueue/commit/0f7a1376bbbd8c7658030d02e51c10a85b1dfdf7
web
-
github.com
/CPS-IT/mailqueue/commit/600c7dba99f8eea5f2505b848ee3dd4713440741
web
-
typo3.org
/security/advisory/typo3-ext-sa-2026-005
vendor-advisory, web
-
github.com
/CPS-IT/mailqueue/security/advisories/GHSA-2pm6-9fhx-vvg3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-1323
advisory
-
github.com
/CPS-IT/mailqueue
package
Sources
- CVE List CVE-2026-1323
- GitHub Advisory GHSA-2pm6-9fhx-vvg3
- NVD CVE-2026-1323
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.