---
id: CVE-2026-120332
title: Cross-Site Scripting in extension "Mail" (mail)
summary: >-
  The HTML content of mails and tracked URLs are rendered unescaped in the
  backend module. Backend users with access to the mail module can inject
  arbitrary HTML and JavaScript, which is executed in the context of other
  backend users viewi…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: TYPO3
product: mediaessenz/mail
affected:
  - mediaessenz/mail >= 4.0.0 < 4.2.0
  - mediaessenz/mail < 3.12.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:23:37.295019Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:32:12.108Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120332'
references:
  - url: 'https://typo3.org/security/advisory/typo3-ext-sa-2026-037'
tags:
  - cve.org
epss: 0.00305
epssPercentile: 0.23375
ingestedAt: '2026-11-05T20:33:06.363Z'
---

## Overview

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

## Affected

- `mediaessenz/mail >= 4.0.0 < 4.2.0`
- `mediaessenz/mail < 3.12.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.