CVE-2026-0859: 
PHP vulnerability analysis and mitigation

CVE-2026-0859 is a PHP object deserialization vulnerability in TYPO3 CMS's mail-file spool functionality, classified as "TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool." Local users with write access to the mail spool directory can craft a malicious serialized file that is deserialized without class restrictions when the mailer:spool:send command executes, enabling arbitrary PHP code execution on the web server. Affected versions span TYPO3 CMS 10.0.0–10.4.54, 11.0.0–11.5.48, 12.0.0–12.4.40, 13.0.0–13.4.22, and 14.0.0–14.0.1. The vulnerability was disclosed on January 13, 2026, with a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 5.2 (Medium) (GitHub Advisory, TYPO3 Advisory).

The root cause (CWE-502: Deserialization of Untrusted Data) lies in the FileSpool transport class (typo3/sysext/core/Classes/Mail/FileSpool.php), which called PHP's unserialize() on spool files with an allowedClasses restriction that contained a typo, rendering the security measure entirely ineffective. As a result, any PHP class available in the application's scope could be instantiated via a crafted serialized payload placed in the spool directory. Exploitation requires the TYPO3 instance to be configured with $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_type'] = 'file' and a scheduler task or cron job that periodically runs mailer:spool:send — at which point the malicious file is deserialized and arbitrary PHP code executes with web server privileges. The fix introduced a new PolymorphicDeserializer component that inspects the serialized payload, extracts all class names, and validates each against an allowlist before calling unserialize() (GitHub Advisory, Patch Commit).

Successful exploitation grants an attacker arbitrary PHP code execution with the privileges of the web server process, enabling complete compromise of the TYPO3 application and the underlying server. This can lead to unauthorized access to sensitive data (database credentials, user data, configuration secrets), unauthorized modification of system files and content, and disruption of service availability. Because the code runs in the web server's context, lateral movement to other services accessible from the server (databases, internal APIs) is also a realistic consequence (GitHub Advisory, TYPO3 Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.045%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local write access to the spool directory and the file-spool transport configuration being enabled, limiting the attacker pool to insiders or attackers who have already achieved some level of local access.

1. Identify target configuration: Confirm the TYPO3 instance is configured with $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_type'] = 'file' and that a scheduler task or cron job runs mailer:spool:send periodically.
2. Gain write access to spool directory: Obtain local write access to the TYPO3 mail spool directory (e.g., via a compromised local account, a web shell from a separate vulnerability, or misconfigured file permissions).
3. Craft malicious serialized payload: Create a PHP serialized object payload that instantiates a gadget chain available in the TYPO3/Symfony class hierarchy, embedding arbitrary PHP code to be executed via magic methods (e.g., __wakeup, __destruct).
4. Place payload in spool directory: Write the crafted serialized file into the TYPO3 mail spool directory with a .message extension (or the expected spool file format) so it will be picked up by the flushQueue operation.
5. Trigger deserialization: Wait for or manually trigger the mailer:spool:send command (via scheduler or CLI). The vulnerable FileSpool::flushQueue() method reads and deserializes the file without effective class restrictions, executing the embedded PHP code with web server privileges (GitHub Advisory, Patch Commit).

• File System: Unexpected or anomalous .message files in the TYPO3 mail spool directory (typically under var/spool/ or a configured path) that do not correspond to legitimate queued emails; files with unusual sizes or binary content inconsistent with normal SentMessage serializations.
• Logs: TYPO3 application log entries such as 'Serialized message from {fileName} was rejected, because it contains a disallowed class object.' (post-patch) indicating attempted exploitation; PHP error log entries showing unexpected class instantiation or fatal errors during unserialize() calls.
• Process: Unexpected child processes spawned by the web server process (e.g., php, bash, curl, wget) during or shortly after scheduled mailer:spool:send execution; unusual outbound network connections from the web server process.
• Logs: Cron/scheduler logs showing mailer:spool:send executions followed by anomalous PHP errors or unexpected output; audit logs showing unauthorized file writes to the spool directory by non-service accounts.

Upgrade TYPO3 CMS to the following patched versions immediately: 10.4.55 (ELTS), 11.5.49 (ELTS), 12.4.41 (LTS), 13.4.23 (LTS), or 14.0.2. As a compensating control, restrict write access to the mail spool directory to only the minimum required service accounts, and implement file integrity monitoring on the spool directory to detect unauthorized file creation. Additionally, review and audit access logs for the spool directory to identify any prior unauthorized write activity. If the file spool transport is not required, consider switching to a different mail transport type (TYPO3 Advisory, GitHub Advisory).

The vulnerability was reported by Vitaly Simonovich and fixed by TYPO3 security team members Elias Häußler and Oliver Hader, who published the advisory on January 13, 2026 (GitHub Advisory). The TYPO3 project issued official security bulletin TYPO3-CORE-SA-2026-004 and provided patches across all supported branches simultaneously (TYPO3 Advisory). Community coverage was limited to standard vulnerability tracking platforms and aggregators; no significant independent researcher commentary or widespread social media discussion was observed.