The Mailqueue extension for TYPO3 incorporates a component of the core FileSpool that was known to allow insecure deserialization, a flaw that enables an attacker to craft serialized objects that, when deserialized, can trigger arbitrary code execution or other malicious behavior. The core vulnerability was addressed in TYPO3‑CORE‑SA‑2026‑004, but the fix was overwritten by the extension, meaning that installations using the patched core with this extension remain vulnerable. This flaw could allow an attacker to compromise the entire web application or execute commands on the server if the input is processed without proper validation.

Any system hosting TYPO3 with the Mailqueue extension is potentially affected, regardless of the core version, because the vulnerable code has been extracted from the core into the extension. No specific version ranges are listed, so all publicly released versions of the Mailqueue extension are considered at risk until a patched version is available. Users should verify that both the core and the extension are updated to the latest releases once a fix is released.

The CVSS score of 5.2 indicates a medium severity, while the EPSS score of less than 1% denotes a very low probability of exploitation under typical circumstances. The flaw is listed as not in the KEV catalogue. The likely attack vector is remote, via the extension’s interfaces that accept serialized input. An attacker would need to provide a crafted serialized payload, potentially through form submissions or API calls handled by the extension. The exploit would succeed if the extension does not enforce strict input validation or limit deserialization to trusted data, enabling arbitrary code execution or privilege escalation on the target system.