TI-2023-27605 Aliases CVE-2023-50461 GHSA-p6xx-fhfw-7mj7

Incorrect authorization in TYPO3 direct_mail

MEDIUM 41CWE-863Published 2026-09-14 · Updated 2026-09-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00514 44th percentileScored 2026-11-08

Fix Fixed direct_mail (TYPO3): 6.0.3, 7.0.3, 9.5.2directmailteam/direct-mail (Packagist): 9.5.2, 7.0.3, 6.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TYPO3	direct_mail	before 6.0.3; 7.0.0 to before 7.0.3; 8.0.0 to before 9.5.2	6.0.3, 7.0.3, 9.5.2	Patch available	CNA
—	directmailteam/direct-mail (Packagist)	8.0.0 to before 9.5.2	9.5.2	Patch available	GHSA-p6xx-fhfw-7mj7
—	directmailteam/direct-mail (Packagist)	7.0.0 to before 7.0.3	7.0.3	Patch available	GHSA-p6xx-fhfw-7mj7
—	directmailteam/direct-mail (Packagist)	before 6.0.3	6.0.3	Patch available	GHSA-p6xx-fhfw-7mj7

direct_mail VendorTYPO3 Affected before 6.0.3; 7.0.0 to before 7.0.3; 8.0.0 to before 9.5.2 Fixed in 6.0.3, 7.0.3, 9.5.2 Patch available CNA
directmailteam/direct-mail (Packagist) Vendor— Affected 8.0.0 to before 9.5.2 Fixed in 9.5.2 Patch available GHSA-p6xx-fhfw-7mj7
directmailteam/direct-mail (Packagist) Vendor— Affected 7.0.0 to before 7.0.3 Fixed in 7.0.3 Patch available GHSA-p6xx-fhfw-7mj7
directmailteam/direct-mail (Packagist) Vendor— Affected before 6.0.3 Fixed in 6.0.3 Patch available GHSA-p6xx-fhfw-7mj7

Remediation

Fix · CNA direct_mail (TYPO3) Fixed in 6.0.3, 7.0.3, 9.5.2
Fix · GHSA-p6xx-fhfw-7mj7 directmailteam/direct-mail (Packagist) Fixed in 9.5.2 Advisory →
Fix · GHSA-p6xx-fhfw-7mj7 directmailteam/direct-mail (Packagist) Fixed in 7.0.3 Advisory →
Fix · GHSA-p6xx-fhfw-7mj7 directmailteam/direct-mail (Packagist) Fixed in 6.0.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-50461
2026-10-03 Alias added: GHSA-p6xx-fhfw-7mj7

References

Other 3

TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0

See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences