High severity · published Mar 17, 2026
CVE-2026-1323
Insecure Deserialization in extension "Mailqueue" (mailqueue)
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Extension "Mailqueue" · TYPO3
before 0.4.5; 0.5.0 before 0.5.2 · source: vendor
MA
Mailqueue · Cps-it
before 0.4.5; 0.5.0 before 0.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1323
Vendor Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2026-005
More from Extension "Mailqueue"
5.2
CVE-2026-0895
Insecure Deserialization in extension "Mailqueue" (mailqueue)