1. Home
  2. CVE Database
  3. CVE-2026-1323
HIGH · 8.8

CVE-2026-1323

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploi...

Vulnerability Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Cps-ItMailqueue< 0.4.5

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2026-1323?

CVE-2026-1323 is a vulnerability with a CVSS score of 8.8 (HIGH). The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploi...

How severe is CVE-2026-1323?

CVE-2026-1323 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-1323?

Check the references section above for vendor advisories and patch information. Affected products include: Cps-It Mailqueue.