Raw vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-0859 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Typo3 Typo3. Its CVSS base score is 5.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-0859 is a deserialization vulnerability in TYPO3 CMS's mail-file spool mechanism, stemming from improper handling of files in the spool directory. The flaw allows malicious files to be deserialized during execution of the mailer:spool:send command, resulting in arbitrary PHP code execution on the web server. It affects TYPO3 CMS versions 10.0.0 through 10.4.54, 11.0.0 through 11.5.48, 12.0.0 through 12.4.40, 13.0.0 through 13.4.22, and 14.0.0 through 14.0.1, and is classified under CWE-502 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local users with write access to the TYPO3 mail spool directory can exploit this vulnerability by crafting a malicious file that gets processed during the mailer:spool:send command. Successful exploitation enables attackers to execute arbitrary PHP code with the privileges of the web server process, potentially leading to full compromise of the TYPO3 instance, including high confidentiality, integrity, and availability impacts.
Mitigation requires updating to patched versions of TYPO3 CMS, as detailed in the official security advisory at https://typo3.org/security/advisory/typo3-core-sa-2026-004. Specific fixes are available in TYPO3 GitHub commits including 3225d705080a1bde57a66689621c947da5a4782f, 722bf71c118b0a8e4f2c2494854437d846799a13, and e0f0ceee480c203fbb60b87454f5f193e541d27f. Security practitioners should restrict write access to the spool directory where possible and monitor for unauthorized file modifications.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2014
Vulnerability Data
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS…
more
versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can uncover deserialization flaws before deployment.
Input validation directly stops deserialization of untrusted data by ensuring inputs are valid before processing.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
Requiring vetted libraries, regular updates and SAST before release reduces the likelihood that deserialization logic will accept and act on attacker-controlled serialized objects.
Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.