---
title: "4.2.0 - 3rd Nov 2026"
manual: "Mail system"
version: "4.2"
permalink: "https://docs.typo3.org/permalink/mediaessenz/mail:4-2-0-3rd-nov-2026@4.2"
source: "ChangeLog/4-2-0.rst"
rendered: "2026-11-03T08:21:25+00:00"
---

# 4.2.0 - 3rd Nov 2026 {#4-2-0-3rd-nov-2026}

-   [Security fixes](https://docs.typo3.org/permalink/mediaessenz/mail:security-fixes@4.2)
-   [New extension setting "allowedFetchHosts"](https://docs.typo3.org/permalink/mediaessenz/mail:new-extension-setting-allowedfetchhosts@4.2)
-   [Content boundaries with the Content Blocks set](https://docs.typo3.org/permalink/mediaessenz/mail:content-boundaries-with-the-content-blocks-set@4.2)
-   [CSV export and import](https://docs.typo3.org/permalink/mediaessenz/mail:csv-export-and-import@4.2)
-   [Performance](https://docs.typo3.org/permalink/mediaessenz/mail:performance@4.2)
-   [Tests](https://docs.typo3.org/permalink/mediaessenz/mail:tests@4.2)
-   [Upgrade notes](https://docs.typo3.org/permalink/mediaessenz/mail:upgrade-notes@4.2)

## Security fixes {#security-fixes}

This release fixes several security issues. Updating is strongly recommended for all installations.

Advisory identifier: TYPO3-EXT-SA-2026-037

-   **Click and opening tracking (frontend)**

    The tracking middleware could be misused as an open redirect and could expose recipient data
    without a valid authentication code. Tracking links now only redirect to links stored in the mail record, the
    tracking pixel is delivered directly, and recipient data is only used if the submitted authentication code is
    valid. Links of already sent mails keep working.

-   **Mail configuration**

    Saving the configuration of the mail module could write arbitrary page TSconfig. Only the settings of the
    configuration views can be written now. Saving the queue configuration requires edit permissions for the page.

-   **Access to mails and recipient groups**

    Backend actions and ajax routes of the modules did not check whether the backend user has access to the page of
    the requested mail or recipient group. Records outside the web mounts of a user can no longer be viewed, changed,
    sent or exported.

-   **Fetching content from external urls (SSRF)**

    Content of external url mails, their stylesheets and images to embed could be fetched from internal network
    addresses. See [allowedFetchHosts](https://docs.typo3.org/permalink/mediaessenz/mail:extension-configuration-allowed-fetch-hosts@4.2) below.

-   **Mail previews in the backend (XSS)**

    The html of mails was rendered directly into backend modules. Previews are now rendered in sandboxed iframes, in
    which no scripts of the mail are executed. Links in the click statistics of reports are only rendered for
    http(s) and mailto urls, values of uploaded CSV files are escaped in the import wizard.

-   **Further hardening**

    The plain text conversion (`?plain=1`) is limited to pages of the mail page type, unserializing data in the
    Direct Mail migration wizard does not allow objects anymore.

## New extension setting "allowedFetchHosts" {#new-extension-setting-allowedfetchhosts}

The server only fetches urls (content of external url mails, their stylesheets and images to embed) whose host
resolves to a public ip address. Hosts of the TYPO3 sites are always trusted.

If content has to be fetched from a host in an internal network (e.g. an intranet or staging server), add it to the
new extension setting `allowedFetchHosts` (comma separated, `*.example.org` matches all sub domains).

Credentials for password secured pages (`httpUsername`, `httpPassword`) are only sent to the site hosts and the
hosts of this setting.

## Content boundaries with the Content Blocks set {#content-boundaries-with-the-content-blocks-set}

With the Content Blocks set `mediaessenz/mail-content-blocks`, the content boundaries were missing in the mail
content since the refactoring of the site sets. The wizard showed the warnings "The HTML content does not contain any
mail boundaries" and all recipients got the complete mail, regardless of the categories of the content elements.

The boundaries are inserted again. Draft mails created in the meantime should be updated with "Reload content" in
the "Settings" step of the wizard.

## CSV export and import {#csv-export-and-import}

Values of exported CSV files starting with `=`, `+`, `-`, `@` and similar characters are no longer cut, but
prefixed with an apostrophe (e.g. `'+49 89 123`). Spreadsheet applications show these values as text without
executing them as formula. The CSV import removes the apostrophe again, so exported files can be imported without
losing data.

Recipients of CSV groups containing quotes are stored correctly again after recipients were deactivated.

## Performance {#performance}

Sending and tracking of mails, the recipient handling and the backend modules have been optimized, e.g.:

-   Recipient categories and frontend user groups are resolved with bulk queries instead of one query per recipient.
-   Attachments, images, markers and SMTP connections are reused while sending a mail.
-   The tracking middleware and the queue state polling no longer load complete mail records.
-   New database indexes for the mail and log tables.
-   The command `mail:analyze-bounce-mail` got a `limit` option (maximum number of messages per run), the option
    `send-per-cycle` of the command `mail:mass-mailing` defaults to 50.

## Tests {#tests}

The extension has unit tests and functional tests now (see the README), which run in the GitLab CI
(unit and functional tests for TYPO3 13 and 14).

## Upgrade notes {#upgrade-notes}

-   Run "Analyze Database Structure" in the install tool (or `typo3 extension:setup`) to add the new database indexes.
-   Check the new extension setting `allowedFetchHosts`, if mails are created from external urls of internal hosts.
-   Flush all caches after updating, so the changed backend JavaScript modules are loaded.