---
id: "CVE-2026-120332"
kind: "vulnerability"
aliases: ["CVE-2026-120332"]
title: "TYPO3 mail module: unescaped HTML lets backend users run scripts"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["backend", "cms", "other", "typo3"]
not_affected_if: ["frontend-only", "no-mail-module-users"]
published_at: "2026-11-03T10:17:18+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:20:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120332", "first_seen_at": "2026-11-03T10:20:16+00:00"}]
---

# TYPO3 mail module: unescaped HTML lets backend users run scripts

Backend users with access to the mail module can inject HTML and JavaScript into mail content and tracked URLs. The script then runs in the browser of other backend users who view the mail preview or report.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120332

## From the sources

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_