CVE-2026-122082: Composer/drupal/mimemail vulnerability
The Mime Mail module gives Drupal sites the ability to send HTML email messages.
Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory,
This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/mimemailto a version that resolves this vulnerability.Fixed in 2.0.4
Event History
Frequently Asked Questions
What access and knowledge would an attacker need to exploit this issue?
The attacker would need permission to send HTML email, the ability to set the recipient list, and advance knowledge of the uploaded non-public files they intend to disclose.
Which sites are most likely to be exposed?
Exposure is limited to Drupal sites using the Mime Mail module under rare site configuration conditions. The issue concerns non-public data uploaded to the files directory.
What can be done if an update cannot be applied immediately?
Restrict the ability to send HTML email and to set email recipients to trusted users. Limiting knowledge of and access to uploaded non-public files also reduces the practical opportunity for exploitation.