---
title: "3.12.5 - 3rd Nov 2026"
manual: "Mail system"
version: "3.12"
permalink: "https://docs.typo3.org/permalink/mediaessenz/mail:3-12-5-3rd-nov-2026@3.12"
source: "ChangeLog/3-12-5.rst"
rendered: "2026-11-03T08:22:20+00:00"
---

# 3.12.5 - 3rd Nov 2026 {#3-12-5-3rd-nov-2026}

-   [Security release](https://docs.typo3.org/permalink/mediaessenz/mail:security-release@3.12)
-   [Tests](https://docs.typo3.org/permalink/mediaessenz/mail:tests@3.12)

## Security release {#security-release}

This release fixes several security issues. **Please update as soon as possible.**
The first issue (open redirect) can be exploited without a login.

Advisory identifier: TYPO3-EXT-SA-2026-037

### Open redirect and forged tracking requests (jumpurl) {#open-redirect-and-forged-tracking-requests-jumpurl}

The tracking links of a mail (`?mail=…&jumpurl=…`) could be used to redirect visitors to any external page, and to
forge click and open statistics.

-   A jump url hash is only issued for link targets stored in the mail record itself.
-   The tracking pixel ("mailer ping") is answered directly with a 1x1 pixel instead of a redirect. Already sent mails
    keep working.
-   If a recipient is part of the link, the auth code is mandatory and compared in a time-safe way. Without a valid auth
    code, the recipient data is not placed into the target url and the request is not logged for the recipient.
-   Unknown mails and links lead to a 404 page instead of an error.

### Page TSconfig injection {#page-tsconfig-injection}

The configuration views of the mail module accepted arbitrary keys, which allowed backend users with edit rights on
a page to write any Page TSconfig. Only the known settings of the mail module can be changed now, keys must be plain
TypoScript object paths. Saving the queue configuration now also requires edit rights on the page.

If you added custom settings to the configuration views, register their keys in
`$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['mail']['additionalConfigurationKeys']`.

### Missing access checks in the backend modules {#missing-access-checks-in-the-backend-modules}

Backend users could access mails and recipient groups outside of their web mounts by passing their uid (including
the download of recipient lists). Actions with a mail, group or page argument now check the page access of the user.
The ajax routes (preview image, category restrictions, queue state) check the module access and the page of the mail.

### Server side request forgery (SSRF) {#server-side-request-forgery-ssrf}

The URLs of external url mails, their stylesheets and the images to embed are only fetched if they use http(s) and
resolve to public ip addresses. Redirects are checked as well. Configured credentials are only sent to hosts of the
TYPO3 sites.

Hosts which resolve to an internal network address, but may be fetched nevertheless, can be configured in the new
extension configuration option `allowedFetchHosts`.

### CSV export and import {#csv-export-and-import}

Values starting with `=`, `+`, `-`, `@` and similar characters are prefixed with an apostrophe in the CSV export to
prevent formula injection in spreadsheet applications. Before, these characters were removed (for example in phone
numbers). The import removes the apostrophe again.

### Cross-site scripting in the backend {#cross-site-scripting-in-the-backend}

Mail previews in the mail wizard, the report and the mail list are rendered in a sandboxed iframe, since the html of a mail
may contain foreign markup. Links in the report are only used if they are http, https or mailto links, and the
column names and example values of the CSV import are escaped.

### Hardening {#hardening}

-   `?plain=1` (plain text conversion) is only applied to pages of the mail page type.
-   `unserialize()` in the Direct Mail migration does not instantiate any classes anymore.

## Tests {#tests}

The extension has unit tests and functional tests now (see the README), which run in the GitLab CI (unit tests for TYPO3 11, 12 and 13, functional tests for TYPO3 12 and 13).