SA-CONTRIB-2026-312: Critical severity composer/drupal/mimemail vulnerability
The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/mimemailto a version that resolves this vulnerability.Fixed in 2.0.4
Event History
Frequently Asked Questions
Which users should be considered capable of exploiting this issue?
Only users who can send HTML emails are described as potential attackers. Exploitation also requires the ability to set the recipient list.
What information would an attacker need before attempting exploitation?
The attacker would need advance knowledge of the uploaded non-public files they intend to expose. The issue is described as occurring only under rare site configuration conditions.