PKSA-spg7-jb73-vpnk: TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)
Published Nov 3, 2026
·Updated
TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)
Affected Software
2 affected componentsFixes available
composer/mediaessenz/mail>=4.0.0, <4.2.0
4.2.0
composer/mediaessenz/mail<3.12.5
3.12.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediaessenz/mailto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
composer/mediaessenz/mailto a version that resolves this vulnerability.Fixed in 3.12.5
Event History
Nov 3, 2026
Advisory Published
via Packagist·09:00 AM
Data Sourced
via Packagist·09:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which package should be checked in an inventory?
Check for the Composer package composer/mediaessenz/mail.
2
Does the available information identify affected versions or a mitigation?
No affected version range, fixed version, configuration workaround, or exploit prerequisites are provided in the available data.