CVE-2026-120331 Details
Description
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
A server-side request forgery (SSRF) vulnerability has been identified in the TYPO3 Mail extension, versions through 4.1.0 and 3.12.4 and prior. This vulnerability allows backend users with access to the mail module to send requests from the server to internal network hosts. The issue arises because the extension fetches content from external URLs included in emails, such as stylesheets and images, without validating the target host.
Users are advised to update to TYPO3 Mail extension versions 3.12.5 or 4.2.0, available from the TYPO3 Extension Manager, Packagist, or the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-037 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Mail | <= 3.12.4 (semver) >= 4.0.0, <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | TYPO3 |