{"id":"CVE-2026-1323","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1323","generatedAt":"2026-10-28T07:04:50.447Z","title":"The extension fails to properly define allowed classes used when deserializing transport failure metadata.","description":"The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].","published":"2026-03-17T09:16:14.000Z","lastModified":"2026-06-17T10:15:36.000Z","status":"Analyzed","sourceIdentifier":"f4fb688c-4412-4426-b4b8-421ecf27b14a","cvss":{"version":"4.0","score":5.2,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-502"],"affected":["cps-it/mailqueue"],"epss":{"score":0.00223,"percentile":0.12822,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-005","tags":["Vendor Advisory"],"source":"f4fb688c-4412-4426-b4b8-421ecf27b14a"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1323","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}