CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
Summary
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
Original description
The description as published by the source.
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- advisory typo3.org
- package github.com
- patch github.com
- patch github.com
- patch github.com
- web packagist.org