Vulnerability · Published Nov 3, 2026 · Assigned by TYPO3
CVE-2026-120331Server-Side Request Forgery in extension "Mail" (mail)
Medium 5.3
In plain English
A medium-severity server-side request forgery in Extension "Mail" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "Mail" | 4.0.0 – before 4.2.00 – before 3.12.5 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory