Remote Code Execution (RCE)

cpsit/typo3-mailqueue is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper restriction of allowed classes during deserialization of transport failure metadata, which allows an attacker to execute arbitrary code if they can write to the configured spool directory...

GHSA-2PM6-9FHX-VVG3 The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Description The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...

Deserialization of Untrusted Data

Overview cpsit/typo3-mailqueue is a TYPO3 CMS extension to improve TYPO3's mail spooler with additional components. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the FileSpool component. An attacker can execute arbitrary code by providing crafted...