4.2.0 - 3rd Nov 2026 

Security fixes 

This release fixes several security issues. Updating is strongly recommended for all installations.

Advisory identifier: TYPO3-EXT-SA-2026-037

Click and opening tracking (frontend)
The tracking middleware could be misused as an open redirect and could expose recipient data without a valid authentication code. Tracking links now only redirect to links stored in the mail record, the tracking pixel is delivered directly, and recipient data is only used if the submitted authentication code is valid. Links of already sent mails keep working.
Mail configuration
Saving the configuration of the mail module could write arbitrary page TSconfig. Only the settings of the configuration views can be written now. Saving the queue configuration requires edit permissions for the page.
Access to mails and recipient groups
Backend actions and ajax routes of the modules did not check whether the backend user has access to the page of the requested mail or recipient group. Records outside the web mounts of a user can no longer be viewed, changed, sent or exported.
Fetching content from external urls (SSRF)
Content of external url mails, their stylesheets and images to embed could be fetched from internal network addresses. See allowedFetchHosts below.
Mail previews in the backend (XSS)
The html of mails was rendered directly into backend modules. Previews are now rendered in sandboxed iframes, in which no scripts of the mail are executed. Links in the click statistics of reports are only rendered for http(s) and mailto urls, values of uploaded CSV files are escaped in the import wizard.
Further hardening
The plain text conversion (?plain=1) is limited to pages of the mail page type, unserializing data in the Direct Mail migration wizard does not allow objects anymore.

New extension setting "allowedFetchHosts" 

The server only fetches urls (content of external url mails, their stylesheets and images to embed) whose host resolves to a public ip address. Hosts of the TYPO3 sites are always trusted.

If content has to be fetched from a host in an internal network (e.g. an intranet or staging server), add it to the new extension setting allowedFetchHosts (comma separated, *.example.org matches all sub domains).

Credentials for password secured pages (httpUsername, httpPassword) are only sent to the site hosts and the hosts of this setting.

Content boundaries with the Content Blocks set 

With the Content Blocks set mediaessenz/mail-content-blocks, the content boundaries were missing in the mail content since the refactoring of the site sets. The wizard showed the warnings "The HTML content does not contain any mail boundaries" and all recipients got the complete mail, regardless of the categories of the content elements.

The boundaries are inserted again. Draft mails created in the meantime should be updated with "Reload content" in the "Settings" step of the wizard.

CSV export and import 

Values of exported CSV files starting with =, +, -, @ and similar characters are no longer cut, but prefixed with an apostrophe (e.g. '+49 89 123). Spreadsheet applications show these values as text without executing them as formula. The CSV import removes the apostrophe again, so exported files can be imported without losing data.

Recipients of CSV groups containing quotes are stored correctly again after recipients were deactivated.

Performance 

Sending and tracking of mails, the recipient handling and the backend modules have been optimized, e.g.:

  • Recipient categories and frontend user groups are resolved with bulk queries instead of one query per recipient.
  • Attachments, images, markers and SMTP connections are reused while sending a mail.
  • The tracking middleware and the queue state polling no longer load complete mail records.
  • New database indexes for the mail and log tables.
  • The command mail:analyze-bounce-mail got a limit option (maximum number of messages per run), the option send-per-cycle of the command mail:mass-mailing defaults to 50.

Tests 

The extension has unit tests and functional tests now (see the README), which run in the GitLab CI (unit and functional tests for TYPO3 13 and 14).

Upgrade notes 

  • Run "Analyze Database Structure" in the install tool (or typo3 extension:setup) to add the new database indexes.
  • Check the new extension setting allowedFetchHosts, if mails are created from external urls of internal hosts.
  • Flush all caches after updating, so the changed backend JavaScript modules are loaded.