Vulnerability in TYPO3 Extension "Mail"

[ Description ]Official description

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4322

  TYPO3 Extension (Mail): Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-120331CVE-2026-120330CVE-2026-120333+4 more CVEs

[ References ]References

• typo3.org/security/advisory/typo3-ext-sa-2026-037