Vulnerability advisory

CVE-2026-0859

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

Published Jan 13, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/benjaminkott/bootstrap_package ↗
a9914eb78915ee33a47e4317637b3b03a692fe58 to before ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96	`ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96`
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before 29ccb6fc4887fcb0f0ceac5bfd24d4993176c412	`29ccb6fc4887fcb0f0ceac5bfd24d4993176c412`
fd8745e46bb11773e85524b8ee9650dabe340713 to before ef75ec889ef10324e61df83ff994db67c4d45255	`ef75ec889ef10324e61df83ff994db67c4d45255`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before 62e93122ec75943aba5553b0aa1c6a50c4ccc27f	`62e93122ec75943aba5553b0aa1c6a50c4ccc27f`
Not specified	`3225d705080a1bde57a66689621c947da5a4782f`
Not specified	`722bf71c118b0a8e4f2c2494854437d846799a13`
Not specified	`e0f0ceee480c203fbb60b87454f5f193e541d27f`
Also listed as affected (77) `14.0.1` `14.0.0` `v13.4.22` `v12.4.40` `v13.4.21` `v14.0.1` `v14.0.0` `v13.4.20` `v12.4.39` `v13.4.19` `v12.4.38` `v13.4.18` `v12.4.37` `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

TYPO3's mail‐file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2026-0859

Affected versions

Repository

Description

References