QwikSec

Security Database

CVE

CWE

Training

CVE-2026-1323

Published: Mar 17, 2026

Modified: Mar 17, 2026

PUBLISHED

Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

Vendor	Product	Versions
TYPO3	Extension "Mailqueue"	affected `0 - < 0.4.5` affected `0.5.0 - < 0.5.2`

Weaknesses (CWE)

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-005

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.