5.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1323

CVE-2026-1323: The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1323

CVE-2026-1323:

5.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cpsit/typo3-mailqueue	composer	< 0.4.5	0.4.5
cpsit/typo3-mailqueue	composer	>= 0.5.0, < 0.5.2	0.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches reveals an insecure deserialization vulnerability within the Cpsit\Mailqueue\Mail\TransportFailure class. The security advisory points to two commits that address the issue. Both commits modify the fromFile static method in Classes/Mail/TransportFailure.php.

The core of the vulnerability is in the call to PHP's unserialize function. The original code attempted to restrict the classes that could be instantiated during deserialization by using the option 'allowedClasses'. However, the correct option name is 'allowed_classes'. This typo meant that no class restrictions were actually applied, allowing an attacker who could control the content of the file being deserialized to instantiate any class available in the application's scope. This could be exploited for various attacks, including remote code execution.

The patch corrects the typo to 'allowed_classes' and explicitly defines the only classes that are safe to be deserialized: self::class (which resolves to Cpsit\Mailqueue\Mail\TransportFailure) and \DateTimeImmutable::class. Therefore, the fromFile method is the vulnerable function as it is responsible for processing the potentially malicious serialized data.

Vulnerable functions

Cpsit\Mailqueue\Mail\TransportFailure::fromFile

Classes/Mail/TransportFailure.php

The `fromFile` method deserializes data from a file using `unserialize`. The vulnerability lies in the use of the incorrect option 'allowedClasses' instead of 'allowed_classes'. This misconfiguration effectively bypasses the class allowlist, permitting an attacker to instantiate arbitrary classes by crafting a malicious file in the mail spool directory, which can lead to remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.