CVE-2026-120332mediumCWE-79

CVE-2026-120332: medium-severity vulnerability in TYPO3 Extension "Mail"

Cross-Site Scripting in extension "Mail" (mail)

Published

Follow this CVE+ Monitor Extension "Mail"

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
TYPO3 · Extension "Mail"
Related CVEs — TYPO3 Extension "Mail"

In the same product, most dangerous first.

CVE-2026-120328MEDIUMInformation Disclosure in extension "Mail" (mail)EPSS 0.4%CVE-2026-120330HIGHBroken Access Control in extension "Mail" (mail)EPSS 0.4%CVE-2026-120327MEDIUMOpen Redirection in extension "Mail" (mail)EPSS 0.3%CVE-2026-120329MEDIUMBroken Access Control in extension "Mail" (mail)EPSS 0.3%CVE-2026-120331MEDIUMServer-Side Request Forgery in extension "Mail" (mail)EPSS 0.3%