CVE-2026-0895: TYPO3 Insecure Deserialization Vulnerability

CVE-2026-0895 Overview

CVE-2026-0895 is an Insecure Deserialization vulnerability affecting the TYPO3 Mailqueue extension's FileSpool component. The extension extends TYPO3's FileSpool component, which was previously vulnerable to Insecure Deserialization as documented in TYPO3-CORE-SA-2026-004. Since the related security fix in TYPO3 core is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization because the affected vulnerable code was extracted from TYPO3 core to the extension.

Critical Impact

Local attackers with low privileges can exploit insecure deserialization to potentially achieve code execution or compromise downstream systems through the FileSpool component.

Affected Products

• TYPO3 Mailqueue Extension (CPS-IT/mailqueue)
• TYPO3 installations using the vulnerable mailqueue extension

Discovery Timeline

• 2026-01-20 - CVE-2026-0895 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0895

Vulnerability Analysis

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The core issue stems from the TYPO3 Mailqueue extension's implementation of the FileSpool component. When TYPO3 core addressed the original deserialization vulnerability through TYPO3-CORE-SA-2026-004, the Mailqueue extension continued to use vulnerable code that was extracted and incorporated into the extension itself.

Insecure deserialization vulnerabilities occur when an application deserializes data from untrusted sources without proper validation. In PHP applications like TYPO3, the unserialize() function can be exploited to instantiate arbitrary objects, potentially leading to remote code execution through Property-Oriented Programming (POP) chains or other attack vectors.

Root Cause

The root cause is the extraction and continued use of vulnerable FileSpool code from TYPO3 core within the Mailqueue extension. When the TYPO3 core was patched to address the original insecure deserialization issue, the extension's codebase was not updated accordingly, leaving the vulnerable deserialization logic intact. This creates a security gap where even systems running patched TYPO3 core versions remain vulnerable if they use this extension.

Attack Vector

The attack vector requires local access with low privileges. An attacker with access to the system could craft malicious serialized data that, when processed by the FileSpool component, triggers the deserialization of arbitrary objects. This could lead to:

• Execution of arbitrary code through gadget chains
• Manipulation of application state
• Potential compromise of downstream systems

The vulnerability mechanism involves the unsafe handling of serialized PHP objects within the FileSpool mail handling component. For detailed technical information, refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-001 and the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004.

Detection Methods for CVE-2026-0895

Indicators of Compromise

• Unexpected serialized PHP object data in mail spool directories or queue files
• Unusual file system activity in TYPO3's mail spool storage locations
• Anomalous PHP object instantiation patterns in application logs
• Unauthorized process execution originating from TYPO3 web application context

Detection Strategies

• Monitor TYPO3 mail queue directories for suspicious serialized content or unexpected file modifications
• Implement file integrity monitoring on the Mailqueue extension's FileSpool-related files
• Review PHP error logs for deserialization errors or unexpected class instantiation
• Deploy application-layer intrusion detection to identify malicious serialized payloads

Monitoring Recommendations

• Enable verbose logging for the TYPO3 Mailqueue extension and FileSpool component
• Configure SentinelOne Singularity XDR to monitor for suspicious PHP deserialization activity and anomalous process chains
• Implement alerting for any changes to extension files or mail spool directories
• Regularly audit installed TYPO3 extensions against known vulnerability databases

How to Mitigate CVE-2026-0895

Immediate Actions Required

• Update the TYPO3 Mailqueue extension to the latest patched version immediately
• Review the security commits available at the GitHub repository
• Temporarily disable the Mailqueue extension if a patch cannot be applied immediately
• Audit mail queue directories for any suspicious serialized data

Patch Information

Security patches have been released to address this vulnerability. The following commits contain the security fixes:

• Commit 12a0a35027bb5609917790a94e43bbf117abf733 - View on GitHub
• Commit fd09aa4e1a751551bae4b228bee814e22f2048db - View on GitHub

For complete advisory details, see TYPO3-EXT-SA-2026-001.

Workarounds

• Disable the Mailqueue extension temporarily if patching is not immediately possible
• Implement strict file permissions on mail spool directories to restrict write access
• Use PHP configuration settings to limit deserializable classes where supported
• Consider implementing a web application firewall (WAF) rule to filter potentially malicious serialized data

# Restrict permissions on TYPO3 mail spool directory
chmod 750 /var/www/html/typo3/var/spool/
chown www-data:www-data /var/www/html/typo3/var/spool/

# Verify the mailqueue extension version
composer show cps-it/mailqueue

# Update to patched version
composer update cps-it/mailqueue