CVE-2026-0895: TYPO3 Insecure Deserialization Vulnerability

CVE-2026-0895 Overview

CVE-2026-0895 is an Insecure Deserialization vulnerability affecting the TYPO3 Mailqueue extension's FileSpool component. The extension extends TYPO3's FileSpool component, which was previously vulnerable to Insecure Deserialization as documented in TYPO3-CORE-SA-2026-004. Since the related security fix in TYPO3 core is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization because the affected vulnerable code was extracted from TYPO3 core to the extension.

Critical Impact
Local attackers with low privileges can exploit insecure deserialization to potentially achieve code execution or compromise downstream systems through the FileSpool component.

Affected Products

TYPO3 Mailqueue Extension (CPS-IT/mailqueue)
TYPO3 installations using the vulnerable mailqueue extension

Discovery Timeline

2026-01-20 - CVE-2026-0895 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0895

Vulnerability Analysis

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The core issue stems from the TYPO3 Mailqueue extension's implementation of the FileSpool component. When TYPO3 core addressed the original deserialization vulnerability through TYPO3-CORE-SA-2026-004, the Mailqueue extension continued to use vulnerable code that was extracted and incorporated into the extension itself.

Insecure deserialization vulnerabilities occur when an application deserializes data from untrusted sources without proper validation. In PHP applications like TYPO3, the unserialize() function can be exploited to instantiate arbitrary objects, potentially leading to remote code execution through Property-Oriented Programming (POP) chains or other attack vectors.

Root Cause

The root cause is the extraction and continued use of vulnerable FileSpool code from TYPO3 core within the Mailqueue extension. When the TYPO3 core was patched to address the original insecure deserialization issue, the extension's codebase was not updated accordingly, leaving the vulnerable deserialization logic intact. This creates a security gap where even systems running patched TYPO3 core versions remain vulnerable if they use this extension.

Attack Vector

The attack vector requires local access with low privileges. An attacker with access to the system could craft malicious serialized data that, when processed by the FileSpool component, triggers the deserialization of arbitrary objects. This could lead to:

Execution of arbitrary code through gadget chains
Manipulation of application state
Potential compromise of downstream systems

The vulnerability mechanism involves the unsafe handling of serialized PHP objects within the FileSpool mail handling component. For detailed technical information, refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-001 and the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004.

Detection Methods for CVE-2026-0895

Indicators of Compromise

Unexpected serialized PHP object data in mail spool directories or queue files
Unusual file system activity in TYPO3's mail spool storage locations
Anomalous PHP object instantiation patterns in application logs
Unauthorized process execution originating from TYPO3 web application context

Detection Strategies

Monitor TYPO3 mail queue directories for suspicious serialized content or unexpected file modifications
Implement file integrity monitoring on the Mailqueue extension's FileSpool-related files
Review PHP error logs for deserialization errors or unexpected class instantiation
Deploy application-layer intrusion detection to identify malicious serialized payloads

Monitoring Recommendations

Enable verbose logging for the TYPO3 Mailqueue extension and FileSpool component
Configure SentinelOne Singularity XDR to monitor for suspicious PHP deserialization activity and anomalous process chains
Implement alerting for any changes to extension files or mail spool directories
Regularly audit installed TYPO3 extensions against known vulnerability databases

How to Mitigate CVE-2026-0895

Immediate Actions Required

Update the TYPO3 Mailqueue extension to the latest patched version immediately
Review the security commits available at the GitHub repository
Temporarily disable the Mailqueue extension if a patch cannot be applied immediately
Audit mail queue directories for any suspicious serialized data

Patch Information

Security patches have been released to address this vulnerability. The following commits contain the security fixes:

Commit 12a0a35027bb5609917790a94e43bbf117abf733 - View on GitHub
Commit fd09aa4e1a751551bae4b228bee814e22f2048db - View on GitHub

For complete advisory details, see TYPO3-EXT-SA-2026-001.

Workarounds

Disable the Mailqueue extension temporarily if patching is not immediately possible
Implement strict file permissions on mail spool directories to restrict write access
Use PHP configuration settings to limit deserializable classes where supported
Consider implementing a web application firewall (WAF) rule to filter potentially malicious serialized data

bash

# Restrict permissions on TYPO3 mail spool directory
chmod 750 /var/www/html/typo3/var/spool/
chown www-data:www-data /var/www/html/typo3/var/spool/

# Verify the mailqueue extension version
composer show cps-it/mailqueue

# Update to patched version
composer update cps-it/mailqueue