TYPO3 CMS extension to improve TYPO3's mail spooler with additional components
68%
Total Score
caution
Usable with caveats: maintenance is concentrated in one contributor and the release workflow has template-injection findings.
The package declares a post-install-cmd lifecycle script. Install-time execution adds some review surface because the script runs during dependency installation, although this signal alone does not show harmful behavior.
One contributor made 100% of the 3 commits in the last 3 months. The organization-owned repository provides some handoff capacity, but no second recently active contributor is shown.
Only 3 commits were recorded in the last 3 months, all from one active maintainer. Recent release and pull-request activity partly offsets the low commit count, but maintenance activity is still thin.
No SECURITY.md policy was found. For a mail-handling extension this reduces transparency around vulnerability reporting, though it does not indicate abandonment by itself.
Version 0.6.0 is not a stable major release, but it is not a prerelease and recent releases have no prerelease share. This is a modest maturity caveat rather than a major concern.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-1323 cpsit/typo3-mailqueue is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 0.4.5 and 0.5.0 - 0.5.2. | 0.0.0 - 0.4.50.5.0 - 0.5.2 | High |
CVE-2026-0895 cpsit/typo3-mailqueue is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 0.4.3 and 0.5.0 - 0.5.1. | 0.0.0 - 0.4.30.5.0 - 0.5.1 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2.0 || ^3.0 | — | — |
symfony/mime Version ^7.0 | — | — |
symfony/mailer Version ^7.0 | — | — |
typo3/cms-core Version ~13.4.23 | — | — |
symfony/console Version ^7.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.