CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
概要
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory typo3.org
- package github.com
- patch github.com
- patch github.com
- patch github.com
- web packagist.org