SSRF in TYPO3 Extension "Mail"

CVE-2026-120331

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published · last modified .

EPSS exploit prediction

EPSS: 0.004 (28.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 28.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Weakness classification (CWE)

References