Server-Side Request Forgery Vulnerability in TYPO3 Backend Mail Module

CVE-2026-120331

What is CVE-2026-120331?

This vulnerability allows backend users with access to the mail module of TYPO3 to make the server issue requests to any external URL. Notably, the server retrieves content, styles, and images without verifying the target host. This can potentially be exploited to gain unauthorized access to the internal network, posing significant security risks.

References