GitHub Advisoryadvisory · Packagist
GHSA-ggff-9mj3-7246 mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport
MEDIUM
Official page ↗
- Aliases
- CVE-2026-0895
- Ecosystem
- Packagist
- Packages
- cpsit/typo3-mailqueue
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
- Weaknesses
- CWE-502
- Reviewed
- 2026-01-21
Affected packages
• Packagist cpsit/typo3-mailqueue: < 0.4.3 → fixed in 0.4.3
• Packagist cpsit/typo3-mailqueue: >= 0.5.0, < 0.5.1 → fixed in 0.5.1
Description
Description
The extension extends TYPO3’s FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004. Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension.
More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004.
References
• TYPO3-EXT-SA-2026-001
• https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db
• https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733
Related
Alias · CVE (1)
- CVE-2026-0895 The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/CPS-IT/mailqueue/security/advisories/GHSA-ggff-9mj3-7246 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-0895 advisory
- https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733 web
- https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db web
- https://github.com/CPS-IT/mailqueue package
- https://typo3.org/security/advisory/typo3-ext-sa-2026-001 web