Description

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T07:17:15.653Z",
  "pubdate": "2026-09-14T07:17:15.653Z",
  "executiveSummary": "The Direct Mail extension for TYPO3 is susceptible to a configuration injection vulnerability within its Configuration backend module, affecting all versions up to and including 9.5.1.\nThe vulnerability allows an authenticated backend user with access to the specific module to manipulate TSConfig settings for folders designated as Direct Mail.\nDepending on the underlying TYPO3 environment, this flaw escalates to either Configuration Injection in versions 10.4 and above, or Remote Code Execution (RCE) in versions 9.5 and below.\nThe risk is categorized as high due to the potential for complete system compromise if the attacker successfully injects malicious configurations.\nExploitation requires a valid backend user account with module-specific permissions, meaning the attack is primarily limited to authenticated users, potentially including compromised low-privileged accounts or malicious insiders.",
  "technicalDetails": "The vulnerability originates in the 'Configuration' backend module of the Direct Mail extension. The module fails to implement adequate input validation and sanitization when handling write operations to TSConfig page properties for folders configured within the Direct Mail context.\nTSConfig (TypoScript Configuration) is a powerful mechanism in TYPO3 used to configure backend user permissions, module behavior, and various site-wide settings. By exploiting the lack of strict input filtering, an attacker can perform an injection attack, overwriting or appending malicious TSConfig directives to the configuration of a target page.\nIn TYPO3 versions 9.5 and below, the backend environment interprets injected TSConfig in a manner that facilitates arbitrary code execution. Because these versions may rely on certain legacy patterns or specific object configurations, an attacker can manipulate properties to trigger system-level operations or execute arbitrary PHP code via specialized backend hooks.\nFor TYPO3 versions 10.4 and above, the impact is primarily classified as Configuration Injection. In these environments, the attacker can hijack backend user settings, circumvent access control lists, or alter system behavior, which may lead to privilege escalation or secondary attacks within the CMS ecosystem.\nThe attack flow follows a sequential process: 1. The attacker authenticates as a backend user with access rights to the Direct Mail extension's 'Configuration' module. 2. The attacker navigates to the configuration panel, where they target a specific folder managed by Direct Mail. 3. The attacker submits a crafted payload into the configuration fields, designed to inject malicious TSConfig parameters. 4. The application processes these parameters without validating the input structure. 5. The injected TSConfig is saved to the TYPO3 database. 6. Subsequent interactions with the affected page or module trigger the execution of the injected configuration, resulting in either configuration tampering or code execution based on the TYPO3 core version."
}