VYPR
← All advisories
High severity8.8NVD Advisory· Published Mar 17, 2026· Updated Apr 25, 2026

CVE-2026-1323

CVE-2026-1323

Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cpsit/typo3-mailqueuePackagist
< 0.4.50.4.5
cpsit/typo3-mailqueuePackagist
>= 0.5.0, < 0.5.20.5.2

Affected products

1
  • Cps It/Mailqueue
    cpe:2.3:a:cps-it:mailqueue:*:*:*:*:*:typo3:*:*
    Range: <0.4.5

Patches

2
600c7dba99f8

[SECURITY] Harden deserialization in `TransportFailure`

https://github.com/CPS-IT/mailqueueElias HäußlerJan 22, 2026via ghsa
commit
1 file changed · +2 −1
  • Classes/Mail/TransportFailure.php+2 −1 modified
    @@ -60,7 +60,8 @@ public static function fromFile(string $file): self
         }
 
         $failure = unserialize((string)file_get_contents($file), [
-            'allowedClasses' => [
+            'allowed_classes' => [
+                self::class,
                 \DateTimeImmutable::class,
             ],
         ]);
0f7a1376bbbd

[SECURITY] Harden deserialization in `TransportFailure`

https://github.com/CPS-IT/mailqueueElias HäußlerJan 22, 2026via ghsa
commit
1 file changed · +2 −1
  • Classes/Mail/TransportFailure.php+2 −1 modified
    @@ -54,7 +54,8 @@ public static function fromFile(string $file): self
         }
 
         $failure = unserialize((string)file_get_contents($file), [
-            'allowedClasses' => [
+            'allowed_classes' => [
+                self::class,
                 \DateTimeImmutable::class,
             ],
         ]);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.