3.12.5 - 3rd Nov 2026 

Open redirect and forged tracking requests (jumpurl) 

The tracking links of a mail (?mail=…&jumpurl=…) could be used to redirect visitors to any external page, and to forge click and open statistics.

• A jump url hash is only issued for link targets stored in the mail record itself.
• The tracking pixel ("mailer ping") is answered directly with a 1x1 pixel instead of a redirect. Already sent mails keep working.
• If a recipient is part of the link, the auth code is mandatory and compared in a time-safe way. Without a valid auth code, the recipient data is not placed into the target url and the request is not logged for the recipient.
• Unknown mails and links lead to a 404 page instead of an error.

Page TSconfig injection 

The configuration views of the mail module accepted arbitrary keys, which allowed backend users with edit rights on a page to write any Page TSconfig. Only the known settings of the mail module can be changed now, keys must be plain TypoScript object paths. Saving the queue configuration now also requires edit rights on the page.

If you added custom settings to the configuration views, register their keys in $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['mail']['additionalConfigurationKeys'].

Missing access checks in the backend modules 

Backend users could access mails and recipient groups outside of their web mounts by passing their uid (including the download of recipient lists). Actions with a mail, group or page argument now check the page access of the user. The ajax routes (preview image, category restrictions, queue state) check the module access and the page of the mail.

Server side request forgery (SSRF) 

The URLs of external url mails, their stylesheets and the images to embed are only fetched if they use http(s) and resolve to public ip addresses. Redirects are checked as well. Configured credentials are only sent to hosts of the TYPO3 sites.

Hosts which resolve to an internal network address, but may be fetched nevertheless, can be configured in the new extension configuration option allowedFetchHosts.

CSV export and import 

Values starting with =, +, -, @ and similar characters are prefixed with an apostrophe in the CSV export to prevent formula injection in spreadsheet applications. Before, these characters were removed (for example in phone numbers). The import removes the apostrophe again.

Cross-site scripting in the backend 

Mail previews in the mail wizard, the report and the mail list are rendered in a sandboxed iframe, since the html of a mail may contain foreign markup. Links in the report are only used if they are http, https or mailto links, and the column names and example values of the CSV import are escaped.

Hardening 

• ?plain=1 (plain text conversion) is only applied to pages of the mail page type.
• unserialize() in the Direct Mail migration does not instantiate any classes anymore.