5.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0859

CVE-2026-0859: TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0859

CVE-2026-0859:

5.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-core	composer	>= 14.0.0, <= 14.0.1	14.0.2
typo3/cms-core	composer	>= 13.0.0, <= 13.4.22	13.4.23
typo3/cms-core	composer	>= 12.0.0, <= 12.4.40	12.4.41
typo3/cms-core	composer	>= 11.0.0, <= 11.5.48	11.5.49
typo3/cms-core	composer	>= 10.0.0, <= 10.4.54	10.4.55

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insecure deserialization of mail messages within the TYPO3 CMS core. The analysis of the provided patches reveals that the flushQueue method in the TYPO3\CMS\Core\Mail\FileSpool class was the culprit. Before the fix, this method used PHP's native unserialize function with an allowedClasses list that was ineffective, as stated in the commit message ("An existing security measure to limit deserialization to said classes is already in place, but contained a typo. Hence, the security measures did not have any effect."). This flaw allowed a local attacker who could write to the mail spool directory to inject a serialized PHP object into a mail spool file. The subsequent execution of the mailer:spool:send command would trigger the deserialization of this malicious object, resulting in arbitrary code execution. The patch rectifies this by introducing a new PolymorphicDeserializer class, which safely validates the classes within the serialized data before deserialization occurs. The flushQueue method was modified to use this new, secure deserializer, thus mitigating the vulnerability. Therefore, the TYPO3\CMS\Core\Mail\FileSpool::flushQueue function is the specific runtime indicator that would be observed during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.