Description
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
INFO
Published Date :
2026-03-17T08:33:05.160Z
Last Modified :
2026-03-17T13:18:18.900Z
Source :
TYPO3
AFFECTED PRODUCTS
The following products are affected by CVE-2026-1323 vulnerability.
| Vendors | Products |
|---|---|
| Typo3 |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-1323.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability