CVE-2026-0895

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-0895
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0895.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-0895
Aliases
Published
2026-01-20T07:19:00.786Z
Modified
2026-07-08T07:59:43.720306902Z
Severity
  • 5.2 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Insecure Deserialization in extension "Mailqueue" (mailqueue)
Details

The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .

Database specific 
{
    "cna_assigner": "TYPO3",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0895.json"
}
References

Affected packages

Git / github.com/cps-it/mailqueue

Affected ranges

Type
GIT
Repo
https://github.com/cps-it/mailqueue
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
81eb05b720512f78953dcedbd5a226addb9c8701
Fixed
bc243a658463b8be761eabf6b1fb1db76aac349c
Fixed
e3748776d109729a376a06075a99d7bcf475babc
Fixed
12a0a35027bb5609917790a94e43bbf117abf733
Fixed
fd09aa4e1a751551bae4b228bee814e22f2048db
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.3"
        },
        {
            "introduced": "0.5.0"
        },
        {
            "fixed": "0.5.1"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0895.json"