The vulnerability arises from the mail‑file spool deserialization process in TYPO3 CMS. A local user who can write to the spool directory can place a crafted file that is deserialized when the mailer:spool:send command runs. During deserialization, PHP code embedded in the file is executed on the server, giving the attacker arbitrary PHP code execution on the web server. The flaw is a classic instance of insecure deserialization, identified as CWE‑502.

TYPO3 CMS is affected. The vulnerable releases are 10.0.0 through 10.4.54, 11.0.0 through 11.5.48, 12.0.0 through 12.4.40, 13.0.0 through 13.4.22, and 14.0.0 through 14.0.1. All versions in these ranges are at risk if the spool directory is writable by local users.

The CVSS base score of 5.2 indicates moderate severity. The EPSS score is less than 1 %, suggesting a very low exploitation probability under current conditions, and the issue is not yet listed in CISA’s KEV catalog. The primary attack vector is local; an attacker must have file‑system write access to the spool directory. If the spool directory is exposed to users with such privileges, the attacker can trigger code execution by running the spool send command. While the likelihood is low, the impact of successful exploitation would be complete compromise of the affected CMS installation.