CVE-2026-120331: TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)

Q: Who can exploit this issue?

An attacker needs backend-user access to the TYPO3 mail module. They can then cause the server to request hosts on the internal network by using external URL mail content, stylesheets, or images.

Q: What functionality is affected?

The affected extension fetches the content of external URL mails and resources referenced for embedding, including stylesheets and images. The target host is not validated before the server makes the request.

Q: What is the impact of successful exploitation?

Successful exploitation lets an authorized backend user use the server to send requests to internal-network hosts. The provided information does not indicate that confidentiality, integrity, or availability impacts extend beyond those requests.

Published Nov 3, 2026

Updated

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

Other sources

TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)

— Packagist

Affected Software

2 affected componentsFixes available

composer/mediaessenz/mail>=4.0.0, <4.2.0

4.2.0

composer/mediaessenz/mail<3.12.5

3.12.5

Event History

Nov 3, 2026

Advisory Published

via Packagist·09:00 AM

Data Sourced

via Packagist·09:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·09:56 AM

Data Sourced

via MITRE·09:56 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs backend-user access to the TYPO3 mail module. They can then cause the server to request hosts on the internal network by using external URL mail content, stylesheets, or images.

What functionality is affected?

The affected extension fetches the content of external URL mails and resources referenced for embedding, including stylesheets and images. The target host is not validated before the server makes the request.

What is the impact of successful exploitation?

Successful exploitation lets an authorized backend user use the server to send requests to internal-network hosts. The provided information does not indicate that confidentiality, integrity, or availability impacts extend beyond those requests.

CVE-2026-120331: TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)

Other sources

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What functionality is affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What functionality is affected?

What is the impact of successful exploitation?