TYPO3 13.4.24 and 12.4.42: Maintenance releases fix mail and redirect problems

On January 20, 2026, the TYPO3 team released two maintenance releases: TYPO3 13.4.24 LTS and TYPO3 12.4.42 LTS. Both versions fix two regressions from the previous releases (13.4.23 and 12.4.41) that were introduced by security patches.

Source: Official announcement on TYPO3.com

What has been fixed?

Problem 1: FileSpool regression (e-mail dispatch)

Emails with complex MIME structures (attachments, embedded files or AbstractPart objects) were incorrectly rejected by the FileSpool and deleted from the queue. This means that valid emails with attachments were lost if sending failed for any reason.

What exactly happened?

• TYPO3 tried to send an email with an attachment
• In the event of an error (e.g. mail server not available), the email was marked as an "invalid object"
• The email was completely deleted instead of being kept for another attempt

The solution:

• Failed emails are now saved with the extension ".invalid" (for debugging)
• Correct processing of MIME parts has been restored
• Emails are retained for resending attempts

Problem 2: RedirectPermissionGuard regression (backend access)

Backend users without admin rights received a 503 error when accessing the "Redirects" module if there were redirects to files from fileadmin with typolink-encoded link parameters.

What exactly happened?

• A redirect to a file was created with a link parameter (e.g. t3://file?uid=3 - - - linkparam)
• When the redirects module was opened by a non-admin user, the complete UID string was passed instead of just the numeric UID
• The system threw a 503 error with the message "The UID of file has to be numeric"

The solution:

• Typolink-encoded destinations are now correctly resolved before the authorization check takes place
• Only the numeric UID is extracted and checked

Do I need to update?

You are affected if...

• your TYPO3 installation sends emails with attachments via the FileSpool (e.g. forms with file upload, automatic reports)
• you use the Redirects module and non-admin users have access to it

You are probably not affected if...

• you do not send emails with attachments
• you do not use the redirects module or only admins have access to it

Nevertheless: maintenance releases should be installed promptly. No database updates required, cache should be emptied after the update.

How do I install the update?

With Composer (recommended):

composer update "typo3/cms-*" -W

Without Composer:

Download the new version from get.typo3.org and replace the old files.

Technical details

The fixes have been implemented in these changesets:

• FileSpool-Fix: Changeset e54ef9fe
• RedirectPermissionGuard-Fix: Changeset 43fce653

Both problems were classified as regressions and fixed with high priority. The FileSpool problem had the priority "must have", as data loss (lost emails) occurred.