CVE-2026-120332: TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)

Q: Who can exploit this issue?

A backend user who has access to the Mail module can inject arbitrary HTML and JavaScript through mail content or tracked URLs.

Q: Who is exposed to the injected code?

Other backend users are exposed when they view the affected mail preview or report. The code executes in the context of the viewing backend user.

Q: Does exploitation require user interaction?

Yes. A backend user must view a mail preview or report containing the malicious content or tracked URL.

Q: What can be done if patching is not immediately possible?

Restrict access to the Mail module to trusted backend users, since Mail-module access is required to inject the malicious content.

Published Nov 3, 2026

Updated

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

Other sources

TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)

— Packagist

Affected Software

2 affected componentsFixes available

composer/mediaessenz/mail>=4.0.0, <4.2.0

4.2.0

composer/mediaessenz/mail<3.12.5

3.12.5

Event History

Nov 3, 2026

Advisory Published

via Packagist·09:00 AM

Data Sourced

via Packagist·09:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·09:56 AM

Data Sourced

via MITRE·09:56 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A backend user who has access to the Mail module can inject arbitrary HTML and JavaScript through mail content or tracked URLs.

Who is exposed to the injected code?

Other backend users are exposed when they view the affected mail preview or report. The code executes in the context of the viewing backend user.

Does exploitation require user interaction?

Yes. A backend user must view a mail preview or report containing the malicious content or tracked URL.

What can be done if patching is not immediately possible?

Restrict access to the Mail module to trusted backend users, since Mail-module access is required to inject the malicious content.

CVE-2026-120332: TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)

Other sources

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Who is exposed to the injected code?

Does exploitation require user interaction?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Who is exposed to the injected code?

Does exploitation require user interaction?

What can be done if patching is not immediately possible?