[IT-SecNots] [Security-news] Mime Mail - Moderately critical - Information disclosure - SA-CONTRIB-2026-312

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-312

Project: Mime Mail [1]
Project machine name: mimemail
Date: 2026-November-04
Security risk: *Moderately critical* 10 ∕ 25
AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information disclosure

Affected versions: <2.0.4
CVE IDs: CVE-2026-122082
Description: 
The Mime Mail module gives Drupal sites the ability to send HTML email
messages.

Under rare site configuration conditions, a user with the ability to send
HTML emails could send non-public data that had been uploaded to the files
directory,

This vulnerability is mitigated by the fact the attacker would need advance
knowledge of uploaded files, and to send HTML emails and set the recipient
list.

Solution: 
Install the latest version:

 * Upgrade to Mime Mail 2.0.4 [3].

Reported By: 
 * Rodel Duterte (rduterte) [4]

Fixed By: 
 * Mark Fullmer (mark_fullmer) [5]
 * Rodel Duterte (rduterte) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/mimemail
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/mimemail/releases/2.0.4
[4] https://www.drupal.org/u/rduterte
[5] https://www.drupal.org/u/mark_fullmer
[6] https://www.drupal.org/u/rduterte
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3633268

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at