HTML Injection Vulnerability in TYPO3 Mail Module by TYPO3
CVE-2026-120332

5.1MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "mail"
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120332?

The TYPO3 Mail Module is vulnerable to HTML injection, allowing backend users with access to the mail functionalities to manipulate content. This flaw lets attackers inject arbitrary HTML and JavaScript, executed when other backend users preview mails or reports. Such vulnerabilities can lead to unauthorized actions and potential data exposure among users sharing the backend interface.

Affected Version(s)

Extension "Mail" 4.0.0 < 4.2.0

Extension "Mail" 0 < 3.12.5

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-037
vendor-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander Grein
Alexander Grein
.