CVE-2026-0895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0895", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2026-01-13T15:24:31.992Z", "datePublished": "2026-01-20T07:19:00.786Z", "dateUpdated": "2026-01-20T18:07:10.983Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://packagist.org/", "defaultStatus": "unaffected", "packageName": "cpsit/typo3-mailqueue", "product": "Extension \"Mailqueue\"", "repo": "https://github.com/CPS-IT/mailqueue", "vendor": "TYPO3", "versions": [{"lessThan": "0.4.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "0.5.1", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Elias H\u00e4u\u00dfler"}, {"lang": "en", "type": "remediation developer", "value": "Elias H\u00e4u\u00dfler"}], "datePublic": "2026-01-20T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The extension extends TYPO3\u2019 <code>FileSpool</code> component, which was vulnerable to Insecure Deserialization prior to <a target=\"_blank\" rel=\"nofollow\" href=\"https://typo3.org/security/advisory/typo3-core-sa-2026-004\">TYPO3-CORE-SA-2026-004</a>. Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory <a target=\"_blank\" rel=\"nofollow\" href=\"https://typo3.org/security/advisory/typo3-core-sa-2026-004\">TYPO3-CORE-SA-2026-004</a>."}], "value": "The extension extends TYPO3\u2019 FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 ."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.2, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-01-20T07:21:28.109Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-001"}, {"tags": ["patch"], "url": "https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db"}, {"tags": ["patch"], "url": "https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure Deserialization in extension \"Mailqueue\" (mailqueue)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T17:56:49.546112Z", "id": "CVE-2026-0895", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T18:07:10.983Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T17:56:49.546112Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T17:58:37.063Z"}}], "cna": {"title": "Insecure Deserialization in extension \"Mailqueue\" (mailqueue)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Elias H\u00e4u\u00dfler"}, {"lang": "en", "type": "remediation developer", "value": "Elias H\u00e4u\u00dfler"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/CPS-IT/mailqueue", "vendor": "TYPO3", "product": "Extension \"Mailqueue\"", "versions": [{"status": "affected", "version": "0", "lessThan": "0.4.3", "versionType": "semver"}, {"status": "affected", "version": "0.5.0", "lessThan": "0.5.1", "versionType": "semver"}], "packageName": "cpsit/typo3-mailqueue", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-01-20T07:00:00.000Z", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-001", "tags": ["vendor-advisory"]}, {"url": "https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db", "tags": ["patch"]}, {"url": "https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The extension extends TYPO3\u2019 FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .", "supportingMedia": [{"type": "text/html", "value": "The extension extends TYPO3\u2019 <code>FileSpool</code> component, which was vulnerable to Insecure Deserialization prior to <a target=\"_blank\" rel=\"nofollow\" href=\"https://typo3.org/security/advisory/typo3-core-sa-2026-004\">TYPO3-CORE-SA-2026-004</a>. Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory <a target=\"_blank\" rel=\"nofollow\" href=\"https://typo3.org/security/advisory/typo3-core-sa-2026-004\">TYPO3-CORE-SA-2026-004</a>.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-01-20T07:21:28.109Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0895", "state": "PUBLISHED", "dateUpdated": "2026-01-20T18:07:10.983Z", "dateReserved": "2026-01-13T15:24:31.992Z", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "datePublished": "2026-01-20T07:19:00.786Z", "assignerShortName": "TYPO3"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/", "defaultStatus": "unaffected", "packageName": "cpsit/typo3-mailqueue", "product": "Extension \"Mailqueue\"", "repo": "https://github.com/CPS-IT/mailqueue", "vendor": "TYPO3", "versions": [{"lessThan": "0.4.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "0.5.1", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The extension extends TYPO3\u2019 FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 ."}, {"lang": "es", "value": "La extensi\u00f3n extiende el componente FileSpool de TYPO3, que era vulnerable a deserializaci\u00f3n insegura antes de TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004. Dado que la correcci\u00f3n relacionada es sobrescrita por la extensi\u00f3n, usar la extensi\u00f3n con una versi\u00f3n del n\u00facleo de TYPO3 parcheada a\u00fan permite la deserializaci\u00f3n insegura, porque el c\u00f3digo vulnerable afectado fue extra\u00eddo del n\u00facleo de TYPO3 a la extensi\u00f3n. M\u00e1s informaci\u00f3n sobre esta vulnerabilidad se puede encontrar en el aviso de seguridad del n\u00facleo de TYPO3 relacionado TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004."}], "id": "CVE-2026-0895", "lastModified": "2026-06-17T10:11:35.113", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0895", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T17:56:49.546112Z", "version": "2.0.3"}}]}, "published": "2026-01-20T08:16:01.883", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-001"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:47:08.895417+00:00", "value": {"mitigation_remediation": ["Update the Mailqueue extension to the latest version that incorporates the TYPO3 core deserialization fix, or remove the extension if an update is not available.", "Ensure that the TYPO3 core itself is patched to the latest release that includes TYPO3\u2011CORE\u2011SA\u20112026\u2011004 so that the underlying deserialization flaw is mitigated.", "If the extension cannot be updated or removed, apply a temporary mitigation by restricting the extension\u2019s input sources to trusted origins and disabling any deserialization functionality until a permanent fix is deployed."], "summary": {"action": "Apply Patch", "impact": "Insecure Deserialization"}, "threat_synthesis": {"affected_systems": "Any system hosting TYPO3 with the Mailqueue extension is potentially affected, regardless of the core version, because the vulnerable code has been extracted from the core into the extension. No specific version ranges are listed, so all publicly released versions of the Mailqueue extension are considered at risk until a patched version is available. Users should verify that both the core and the extension are updated to the latest releases once a fix is released.", "description_and_impact": "The Mailqueue extension for TYPO3 incorporates a component of the core FileSpool that was known to allow insecure deserialization, a flaw that enables an attacker to craft serialized objects that, when deserialized, can trigger arbitrary code execution or other malicious behavior. The core vulnerability was addressed in TYPO3\u2011CORE\u2011SA\u20112026\u2011004, but the fix was overwritten by the extension, meaning that installations using the patched core with this extension remain vulnerable. This flaw could allow an attacker to compromise the entire web application or execute commands on the server if the input is processed without proper validation.", "risk_and_exploitability": "The CVSS score of 5.2 indicates a medium severity, while the EPSS score of less than 1% denotes a very low probability of exploitation under typical circumstances. The flaw is listed as not in the KEV catalogue. The likely attack vector is remote, via the extension\u2019s interfaces that accept serialized input. An attacker would need to provide a crafted serialized payload, potentially through form submissions or API calls handled by the extension. The exploit would succeed if the extension does not enforce strict input validation or limit deserialization to trusted data, enabling arbitrary code execution or privilege escalation on the target system."}}}}, "created": "2026-01-21T11:19:41.963131+00:00", "updated": "2026-04-18T05:00:06.023625+00:00", "vendors": ["typo3", "typo3$PRODUCT$mailqueue"]}