Listen to this Post
The vulnerability exploits TYPO3’s file-based mail spool system. When configured to use file spooling, serialized email data is stored in a directory. Local users with write access to this directory can create malicious files containing crafted serialized PHP objects. During the scheduled execution of the ‘mailer:spool:send’ command, typically via a cron job or scheduler task, TYPO3 deserializes these spool files without applying any class restrictions or validation. This insecure deserialization process allows arbitrary PHP objects to be instantiated. Attackers can leverage this to invoke magic methods like __wakeup() or __destruct() within deserialized objects, leading to the injection and execution of arbitrary PHP code. The code runs within the web server’s context, potentially compromising the entire application. The exploit requires the specific configuration where ‘transport_spool_type’ is set to ‘file’ and depends on the attacker having local filesystem access to the spool directory, which could be achieved through other weaknesses or misconfigurations.
Platform: TYPO3 CMS
Version: Multiple affected versions
Vulnerability: Insecure deserialization
Severity: Moderate
Date: 2026-01-13
Prediction: Patch released 2026-01-13
What Undercode Say:
Analytics
Bash commands:
grep transport_spool_type typo3conf
ls -la spool_directory
php mailer:spool:send
Codes:
file_put_contents(‘spool/file’, serialized($object));
unserialize($spoolData);
how Exploit:
Write malicious serialized file to spool directory. Trigger deserialization via scheduled mailer command.
Protection from this CVE
Update to patched versions.
Impact:
Arbitrary code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
