CVE-2026-120332

The TYPO3 Extension "Mail" (mail) is vulnerable to Cross-Site Scripting (XSS) due to the backend module rendering the HTML content of emails and tracked URLs without proper escaping. An attacker with backend access to the mail module can inject arbitrary HTML and JavaScript , which executes withi...