View online: https://www.drupal.org/sa-contrib-2026-312 Project: Mime Mail [1] Project machine name: mimemail Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.0.4 CVE IDs: CVE-2026-122082 Description: The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list. Solution: Install the latest version: * Upgrade to Mime Mail 2.0.4 [3]. Reported By: * Rodel Duterte (rduterte) [4] Fixed By: * Mark Fullmer (mark_fullmer) [5] * Rodel Duterte (rduterte) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/mimemail [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/mimemail/releases/2.0.4 [4] https://www.drupal.org/u/rduterte [5] https://www.drupal.org/u/mark_fullmer [6] https://www.drupal.org/u/rduterte [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....