mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport
Description
The extension extends TYPO3’s FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004. Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension.
More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | cpsit/typo3-mailqueue | < 0.4.3, >= 0.5.0, < 0.5.1 | 0.4.3, 0.5.1 |
References
- https://github.com/CPS-IT/mailqueue/security/advisories/GHSA-ggff-9mj3-7246
- https://nvd.nist.gov/vuln/detail/CVE-2026-0895
- https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733
- https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db
- https://github.com/CPS-IT/mailqueue
- https://typo3.org/security/advisory/typo3-ext-sa-2026-001
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H- Weakness (CWE)
CWE-502- Platform
- Composer
- Package
cpsit/typo3-mailqueue- Disclosed
- 21.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-ggff-9mj3-7246 - CC BY 4.0
Vulnerability history: cpsit/typo3-mailqueue
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 01.2026 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2026: 2
-
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.