{"action":"Upgrade cpsit/typo3-mailqueue to 0.4.3 or later.","affected":[{"fixed":"0.4.3","introduced":"0"},{"fixed":"0.5.1","introduced":"0.5.0"}],"component":"cpsit/typo3-mailqueue","cve_ids":["CVE-2026-0895"],"ecosystem":"Packagist","epss":0.00149,"exploited":false,"fixed_versions":["0.4.3","0.5.1"],"ghsa_id":"GHSA-ggff-9mj3-7246","id":"tcs_01M5KF2QKF06QSH413ECNZTTWJ","modified_at":"2026-02-03T03:10:05.271890Z","published_at":"2026-01-21T15:47:44Z","references":["https://osv.dev/vulnerability/GHSA-ggff-9mj3-7246","https://github.com/CPS-IT/mailqueue/security/advisories/GHSA-ggff-9mj3-7246","https://nvd.nist.gov/vuln/detail/CVE-2026-0895","https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb5609917790a94e43bbf117abf733","https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db","https://github.com/CPS-IT/mailqueue","https://typo3.org/security/advisory/typo3-ext-sa-2026-001"],"severity":{"label":"medium","score":5.2},"sources":[{"source":"osv","source_id":"GHSA-ggff-9mj3-7246","url":"https://osv.dev/vulnerability/GHSA-ggff-9mj3-7246"},{"source":"nvd","source_id":"CVE-2026-0895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0895"}],"summary":"mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport"}