Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-9tpm-8udy-c3cd
Summary
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
### Problem
Local platform users who can write to TYPO3’s mail‑file spool directory can craft a file that the system will automatically deserialize without any class restrictions. This flaw allows an attacker to inject and execute arbitrary PHP code in the public scope of the web server.

The vulnerability is triggered when TYPO3 is configured with `$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_type'] = 'file';` and a scheduler task or cron job runs the command `mailer:spool:send`. The spool‑send operation performs the insecure deserialization that is at the core of this issue.

### Solution
Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

### Credits
Thanks to Vitaly Simonovich for reporting this issue, and to TYPO3 security team members Elias Häußler and Oliver Hader for fixing it.

### References
* [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004)
Aliases
0
alias CVE-2026-0859
1
alias GHSA-7vp9-x248-9vr9
Fixed_packages
0
url pkg:composer/typo3/cms-core@12.4.41
purl pkg:composer/typo3/cms-core@12.4.41
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.4.41
1
url pkg:composer/typo3/cms-core@13.4.23
purl pkg:composer/typo3/cms-core@13.4.23
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@13.4.23
2
url pkg:composer/typo3/cms-core@14.0.2
purl pkg:composer/typo3/cms-core@14.0.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@14.0.2
Affected_packages
0
url pkg:composer/typo3/cms-core@10.0.0
purl pkg:composer/typo3/cms-core@10.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1ffs-9vj5-27hk
1
vulnerability VCID-1sfk-z8py-ykb8
2
vulnerability VCID-2rhr-8vaz-hqfj
3
vulnerability VCID-2tz2-8qdm-2kcv
4
vulnerability VCID-3hta-35zx-zuc4
5
vulnerability VCID-4an7-9ph4-mkd4
6
vulnerability VCID-4rfq-u488-sbh5
7
vulnerability VCID-6a22-c7x5-sqe2
8
vulnerability VCID-6mnf-2fcw-dqgp
9
vulnerability VCID-6urp-p9mn-cffv
10
vulnerability VCID-78ff-k66z-bkh7
11
vulnerability VCID-7r4g-gxc6-hubh
12
vulnerability VCID-7snt-7hyt-1fbx
13
vulnerability VCID-848u-w88s-5bbe
14
vulnerability VCID-8w4e-d49b-nbg8
15
vulnerability VCID-9tpm-8udy-c3cd
16
vulnerability VCID-a1g9-pyz5-9fca
17
vulnerability VCID-an3r-c2yp-1bbd
18
vulnerability VCID-bbh5-rss8-bfct
19
vulnerability VCID-bzqv-s7g3-wff9
20
vulnerability VCID-e6zr-4bgg-kkh5
21
vulnerability VCID-etcc-43a3-a7ek
22
vulnerability VCID-ev4k-5k1d-2bhu
23
vulnerability VCID-fgkd-jp96-cbcs
24
vulnerability VCID-fqkx-v8t5-q3h6
25
vulnerability VCID-gxsd-4nd9-gqgn
26
vulnerability VCID-j8hk-bqnb-gycp
27
vulnerability VCID-jp1p-rfxa-hyd9
28
vulnerability VCID-myhc-dyh9-xygg
29
vulnerability VCID-n1gz-y615-cbbk
30
vulnerability VCID-r3az-g422-gqf9
31
vulnerability VCID-rzx5-nv6h-qqhg
32
vulnerability VCID-sdjb-gp4t-vbgt
33
vulnerability VCID-tgyt-axv1-c7ag
34
vulnerability VCID-uq77-aax5-k7d8
35
vulnerability VCID-uua1-9rt1-dfbz
36
vulnerability VCID-w94g-xxea-23fb
37
vulnerability VCID-x3n3-tsjh-8kby
38
vulnerability VCID-y3zj-acc7-jkau
39
vulnerability VCID-ygw1-vqxg-z3h3
40
vulnerability VCID-zkvq-bms4-gfcv
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.0.0
1
url pkg:composer/typo3/cms-core@11.0.0
purl pkg:composer/typo3/cms-core@11.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1ffs-9vj5-27hk
1
vulnerability VCID-2rhr-8vaz-hqfj
2
vulnerability VCID-3hta-35zx-zuc4
3
vulnerability VCID-6a22-c7x5-sqe2
4
vulnerability VCID-6mnf-2fcw-dqgp
5
vulnerability VCID-6urp-p9mn-cffv
6
vulnerability VCID-7r4g-gxc6-hubh
7
vulnerability VCID-7snt-7hyt-1fbx
8
vulnerability VCID-848u-w88s-5bbe
9
vulnerability VCID-9tpm-8udy-c3cd
10
vulnerability VCID-a1g9-pyz5-9fca
11
vulnerability VCID-an3r-c2yp-1bbd
12
vulnerability VCID-bzqv-s7g3-wff9
13
vulnerability VCID-c46m-ht19-ybc4
14
vulnerability VCID-etcc-43a3-a7ek
15
vulnerability VCID-ev4k-5k1d-2bhu
16
vulnerability VCID-fgkd-jp96-cbcs
17
vulnerability VCID-fqkx-v8t5-q3h6
18
vulnerability VCID-fsx8-7qjz-2ubw
19
vulnerability VCID-gxsd-4nd9-gqgn
20
vulnerability VCID-j8hk-bqnb-gycp
21
vulnerability VCID-jp1p-rfxa-hyd9
22
vulnerability VCID-myhc-dyh9-xygg
23
vulnerability VCID-p3nb-urds-euf3
24
vulnerability VCID-rzx5-nv6h-qqhg
25
vulnerability VCID-sdjb-gp4t-vbgt
26
vulnerability VCID-uq77-aax5-k7d8
27
vulnerability VCID-uua1-9rt1-dfbz
28
vulnerability VCID-w94g-xxea-23fb
29
vulnerability VCID-x3n3-tsjh-8kby
30
vulnerability VCID-y3zj-acc7-jkau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.0.0
2
url pkg:composer/typo3/cms-core@12.0.0
purl pkg:composer/typo3/cms-core@12.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3hta-35zx-zuc4
1
vulnerability VCID-5e9k-tfy9-ufcx
2
vulnerability VCID-6a22-c7x5-sqe2
3
vulnerability VCID-7r4g-gxc6-hubh
4
vulnerability VCID-7snt-7hyt-1fbx
5
vulnerability VCID-9tpm-8udy-c3cd
6
vulnerability VCID-an3r-c2yp-1bbd
7
vulnerability VCID-bzqv-s7g3-wff9
8
vulnerability VCID-etcc-43a3-a7ek
9
vulnerability VCID-fgkd-jp96-cbcs
10
vulnerability VCID-gxsd-4nd9-gqgn
11
vulnerability VCID-myhc-dyh9-xygg
12
vulnerability VCID-p3nb-urds-euf3
13
vulnerability VCID-rzx5-nv6h-qqhg
14
vulnerability VCID-uua1-9rt1-dfbz
15
vulnerability VCID-w94g-xxea-23fb
16
vulnerability VCID-x3n3-tsjh-8kby
17
vulnerability VCID-y3zj-acc7-jkau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.0.0
3
url pkg:composer/typo3/cms-core@13.0.0
purl pkg:composer/typo3/cms-core@13.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3hta-35zx-zuc4
1
vulnerability VCID-5e9k-tfy9-ufcx
2
vulnerability VCID-7r4g-gxc6-hubh
3
vulnerability VCID-7snt-7hyt-1fbx
4
vulnerability VCID-9tpm-8udy-c3cd
5
vulnerability VCID-an3r-c2yp-1bbd
6
vulnerability VCID-c91z-btmf-87dz
7
vulnerability VCID-etcc-43a3-a7ek
8
vulnerability VCID-fgkd-jp96-cbcs
9
vulnerability VCID-myhc-dyh9-xygg
10
vulnerability VCID-p3nb-urds-euf3
11
vulnerability VCID-rzx5-nv6h-qqhg
12
vulnerability VCID-uua1-9rt1-dfbz
13
vulnerability VCID-uw3m-2f4s-s3fj
14
vulnerability VCID-w94g-xxea-23fb
15
vulnerability VCID-x3n3-tsjh-8kby
16
vulnerability VCID-y3zj-acc7-jkau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@13.0.0
4
url pkg:composer/typo3/cms-core@14.0.0
purl pkg:composer/typo3/cms-core@14.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9tpm-8udy-c3cd
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@14.0.0
References
0
reference_url https://github.com/TYPO3/typo3
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/TYPO3/typo3
1
reference_url https://github.com/TYPO3/typo3/commit/3225d705080a1bde57a66689621c947da5a4782f
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/TYPO3/typo3/commit/3225d705080a1bde57a66689621c947da5a4782f
2
reference_url https://github.com/TYPO3/typo3/commit/722bf71c118b0a8e4f2c2494854437d846799a13
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/TYPO3/typo3/commit/722bf71c118b0a8e4f2c2494854437d846799a13
3
reference_url https://github.com/TYPO3/typo3/commit/e0f0ceee480c203fbb60b87454f5f193e541d27f
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/TYPO3/typo3/commit/e0f0ceee480c203fbb60b87454f5f193e541d27f
4
reference_url https://typo3.org/security/advisory/typo3-core-sa-2026-004
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://typo3.org/security/advisory/typo3-core-sa-2026-004
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-0859
reference_id CVE-2026-0859
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-0859
6
reference_url https://github.com/advisories/GHSA-7vp9-x248-9vr9
reference_id GHSA-7vp9-x248-9vr9
reference_type
scores
url https://github.com/advisories/GHSA-7vp9-x248-9vr9
7
reference_url https://github.com/TYPO3/typo3/security/advisories/GHSA-7vp9-x248-9vr9
reference_id GHSA-7vp9-x248-9vr9
reference_type
scores
0
value 5.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/TYPO3/typo3/security/advisories/GHSA-7vp9-x248-9vr9
Weaknesses
0
cwe_id 502
name Deserialization of Untrusted Data
description The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-9tpm-8udy-c3cd