---
id: CVE-2026-120331
title: Server-Side Request Forgery in extension "Mail" (mail)
summary: >-
  Content of external URL mails, their stylesheets and images to embed is
  fetched by the server without validating the target host. Backend users with
  access to the mail module can make the server send requests to hosts in the
  internal net…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: TYPO3
product: mediaessenz/mail
affected:
  - mediaessenz/mail >= 4.0.0 < 4.2.0
  - mediaessenz/mail < 3.12.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:23:32.222440Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:32:05.864Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120331'
references:
  - url: 'https://typo3.org/security/advisory/typo3-ext-sa-2026-037'
tags:
  - cve.org
epss: 0.00269
epssPercentile: 0.19238
ingestedAt: '2026-11-05T20:33:06.363Z'
---

## Overview

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

## Affected

- `mediaessenz/mail >= 4.0.0 < 4.2.0`
- `mediaessenz/mail < 3.12.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.