CVE-2026-1323
Published: 17 March 2026
Description
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization vulnerability by applying vendor patches to properly define allowed classes in the TYPO3 extension.
Enforces least privilege to prevent low-privilege authenticated users from writing malicious serialized data to the mail transport spool directory.
Mitigates arbitrary code execution from unsafe deserialization through memory protections like non-executable memory and address space randomization.
Security SummaryAI
CVE-2026-1323 is a deserialization vulnerability (CWE-502) in a TYPO3 extension, where the component fails to properly define allowed classes during deserialization of transport failure metadata. This flaw affects TYPO3 CMS installations using the vulnerable extension and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with potential for high confidentiality, integrity, and availability impacts. The issue was published on 2026-03-17.
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this vulnerability remotely over the network (AV:N) if they have write access to the directory specified by $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']. By crafting malicious serialized data and placing it in this spool directory, the attacker can trigger deserialization of untrusted code during mail transport failure handling, leading to arbitrary code execution on the server.
For mitigation details, refer to the official TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-005, which likely includes patch information and workarounds for affected installations.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in TYPO3 CMS extension enables remote exploitation of a public-facing web application for arbitrary code execution.