Bug 2565675 (CVE-2026-120331)

Summary: CVE-2026-120331 mail: mail: Server-Side Request Forgery via unvalidated external URLs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, rchan, smallamp, tmalecek, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the TYPO3 mail extension. When retrieving external email content, stylesheets, and embedded images, the server fetches these resources without validating the destination host. An authenticated backend user with access to the mail module can exploit this Server-Side Request Forgery (SSRF) vulnerability to force the server to send unauthorized requests to internal network services. This issue can allow an attacker to probe internal network infrastructure and potentially access restricted services or sensitive internal data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 10:01:50 UTC 
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.