216.73.217.22

CVE-2026-0859

· Published 13/01/2026 12:15 · Modified 14/01/2026 18:57

Labels: CVE-2026-0859 2026-01-13CVE-2026-0859CWE-502f4fb688c-4412-4426-b4b8-421ecf27b14a

Essential information

Published
13/01/2026 12:15
Modified
14/01/2026 18:57
Author
—
Creator
—
CVSS
5.2 MEDIUM (v3) 5.2 MEDIUM (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

NVD status

Status
Analyzed — CVE has been recently published to the CVE List and has been received by the NVD.
Source
f4fb688c-4412-4426-b4b8-421ecf27b14a
NVD
View on NVD

Affected products (CPE)

ProductCPE
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

References