CVE-2026-1323

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1323", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2026-01-22T06:39:32.852Z", "datePublished": "2026-03-17T08:33:05.160Z", "dateUpdated": "2026-03-17T13:18:18.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-03-17T08:33:05.160Z"}, "title": "Insecure Deserialization in extension \"Mailqueue\" (mailqueue)", "datePublic": "2026-03-17T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "affected": [{"vendor": "TYPO3", "product": "Extension \"Mailqueue\"", "collectionURL": "https://packagist.org/", "packageName": "cpsit/typo3-mailqueue", "repo": "https://github.com/CPS-IT/mailqueue", "versions": [{"status": "affected", "version": "0", "lessThan": "0.4.5", "versionType": "semver"}, {"status": "affected", "version": "0.5.0", "lessThan": "0.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at <code>$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']</code>."}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-005", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Elias H\u00e4u\u00dfler", "type": "reporter"}, {"lang": "en", "value": "Elias H\u00e4u\u00dfler", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:18:07.208226Z", "id": "CVE-2026-1323", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:18:18.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1323", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T13:18:07.208226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:18:13.243Z"}}], "cna": {"title": "Insecure Deserialization in extension \"Mailqueue\" (mailqueue)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Elias H\u00e4u\u00dfler"}, {"lang": "en", "type": "remediation developer", "value": "Elias H\u00e4u\u00dfler"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/CPS-IT/mailqueue", "vendor": "TYPO3", "product": "Extension \"Mailqueue\"", "versions": [{"status": "affected", "version": "0", "lessThan": "0.4.5", "versionType": "semver"}, {"status": "affected", "version": "0.5.0", "lessThan": "0.5.2", "versionType": "semver"}], "packageName": "cpsit/typo3-mailqueue", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-03-17T09:00:00.000Z", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-005", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].", "supportingMedia": [{"type": "text/html", "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at <code>$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']</code>.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-03-17T08:33:05.160Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1323", "state": "PUBLISHED", "dateUpdated": "2026-03-17T13:18:18.900Z", "dateReserved": "2026-01-22T06:39:32.852Z", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "datePublished": "2026-03-17T08:33:05.160Z", "assignerShortName": "TYPO3"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/", "defaultStatus": "unaffected", "packageName": "cpsit/typo3-mailqueue", "product": "Extension \"Mailqueue\"", "repo": "https://github.com/CPS-IT/mailqueue", "vendor": "TYPO3", "versions": [{"lessThan": "0.4.5", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "0.5.2", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cps-it:mailqueue:*:*:*:*:*:typo3:*:*", "matchCriteriaId": "E61C4198-A8D5-4F8B-A510-3481AB95EBCF", "versionEndExcluding": "0.4.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cps-it:mailqueue:*:*:*:*:*:typo3:*:*", "matchCriteriaId": "9BE0D821-5BB7-4CA2-BEB2-B5F2AD96B87D", "versionEndExcluding": "0.5.2", "versionStartIncluding": "0.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']."}, {"lang": "es", "value": "La extensi\u00f3n no define correctamente las clases permitidas utilizadas al deserializar metadatos de fallo de transporte. Un atacante puede explotar esto para ejecutar c\u00f3digo serializado no confiable. Tenga en cuenta que un exploit activo requiere acceso de escritura al directorio configurado en $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']."}], "id": "CVE-2026-1323", "lastModified": "2026-06-17T10:15:35.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1323", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:18:07.208226Z", "version": "2.0.3"}}]}, "published": "2026-03-17T09:16:13.507", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-005"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.0,0.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Extension \"Mailqueue\"", "source": "cna", "vendor": "TYPO3"}, "product": "extension_\"mailqueue\"", "vendor": "typo3"}], "analysis": {"en": {"generated_at": "2026-03-17T10:21:40.900574+00:00", "value": {"mitigation_remediation": ["Check the vendor\u2019s website for a patch or updated release of the Mailqueue extension", "Restrict write permissions on the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'] to prevent unauthorized serialized data", "Disable the Mailqueue extension if it is not required for your workflow", "Monitor application logs for unusual deserialization activity or errors related to the Mailqueue extension", "Apply general web application hardening practices such as limiting file uploads and implementing least privilege principles"], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the TYPO3 Mailqueue extension that include the vulnerable deserialization logic may be affected. No specific version list is provided in the CNA data, so all versions should be evaluated until a patch is released.", "description_and_impact": "The TYPO3 extension \"Mailqueue\" contains an insecure deserialization flaw where it fails to define allowed classes when deserializing transport failure metadata. An attacker who can supply crafted serialized data may be able to execute arbitrary code, a classic Remote Code Execution scenario. This vulnerability is classified as CWE\u2011502: Deserialization of Untrusted Data.", "risk_and_exploitability": "The CVSS score of 5.2 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires write access to the directory specified by $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'], which may limit the attack surface to users with file system write privileges. Nevertheless, the potential for remote code execution warrants immediate attention."}}}}, "created": "2026-03-18T12:13:34.443112+00:00", "updated": "2026-03-24T10:49:29.988652+00:00", "vendors": ["typo3", "typo3$PRODUCT$extension_\"mailqueue\""]}