CVE-2026-120329 Details
Description
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
A vulnerability exists in the TYPO3 Mail extension, specifically in versions 3.12.4 and below, as well as 4.0.0 to 4.1.0. When the mail backend module's configuration is saved, the submitted settings are written to the page TSconfig without proper validation, allowing backend users with access to the mail module to inject arbitrary TSconfig settings. This issue could lead to unauthorized modifications of the page configuration.
Users are advised to update to TYPO3 Mail extension versions 3.12.5 or 4.2.0, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-037 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Mail | <= 3.12.4 (semver) >= 4.0.0, <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | TYPO3 |