DRUPAL-CONTRIB-2026-312: Composer/drupal/mimemail vulnerability
The Mime Mail module gives Drupal sites the ability to send HTML email messages.
Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory,
This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/mimemailto a version that resolves this vulnerability.Fixed in 2.0.4
Event History
Frequently Asked Questions
What level of access would an attacker need to exploit this issue?
The attacker would need permission to send HTML email, be able to set the recipient list, and have advance knowledge of the uploaded non-public files they intend to send.
Which sites are most likely to be exposed?
Exposure is limited to rare site configuration conditions where users who can send HTML email could cause non-public data from the files directory to be sent. Sites should review which users have HTML-email sending capability and whether those users can choose recipients.