Loading...
Skip to main content
GeekWala

CVE-2026-0895 — Vulnerability in cpsit/typo3-mailqueue — CVE Details

MEDIUM

mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

Published January 21, 2026Updated February 3, 2026Source: osv

Summary

## Description The extension extends TYPO3’s FileSpool component, which was vulnerable to Insecure Deserialization prior to [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004). Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004). ## References * [TYPO3-EXT-SA-2026-001](https://typo3.org/security/advisory/typo3-ext-sa-2026-001) * https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db * https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733

Advisory Timeline

  • First published January 21, 2026 (264 days ago).
  • Last revised February 3, 2026 — 12 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update cpsit/typo3-mailqueue to 0.4.3 or later
composer require "cpsit/typo3-mailqueue:^0.4.3"
Composer
Update cpsit/typo3-mailqueue to 0.5.1 or later
composer require "cpsit/typo3-mailqueue:^0.5.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
cpsit/typo3-mailqueue
packagist
0.1.0, 0.1.1, 0.1.2, 0.1.3 (+8 more)0.4.3
cpsit/typo3-mailqueue
packagist
0.5.00.5.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.5 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-0895?
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.5/10).
How do I check if my project is affected by CVE-2026-0895?
CVE-2026-0895 affects cpsit/typo3-mailqueue. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-0895 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-ggff-9mj3-7246

Related CVEs

  • CVE-2026-1323
    MEDIUM

    The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

  • CVE-2026-75592
    MEDIUM

    Kirby: Access to image files outside of the site root via path traversal in the media handling

  • CVE-2026-88023
    MEDIUM

    MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies