CVE-2026-77136
Received Received - Intake

Fluid Template Injection in Powermail Extension

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: TYPO3

Description
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-77136
EUVD
EUVD-2026-65340

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
in2code powermail to 10.9.3 (exc)
in2code powermail From 11.0.0 (inc) to 12.6.0 (inc)
in2code powermail From 12.6.1 (inc) to 13.2.0 (inc)
in2code powermail From 13.0.0 (inc) to 13.2.0 (inc)
in2code powermail to 13.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Template Injection (SSTI) vulnerability in the TYPO3 extension 'powermail'. It occurs when a form field named 'sender_name' is configured to pass raw input directly into a Fluid View template without sanitization. An attacker can submit Fluid template syntax in this field to execute arbitrary ViewHelpers, leading to server configuration disclosure, environment variable exposure, application source code access, and potentially remote code execution.

Detection Guidance

Check emails or the database for Fluid syntax indicators like f:, v:, or namespace, which may signal ViewHelper execution and potential compromise.

Impact Analysis

An unauthenticated attacker can exploit this by submitting a normal form with malicious Fluid syntax in the 'sender_name' field. This could allow them to read sensitive server data, access environment variables, view application source code, or execute arbitrary code on the server. No authentication or special user interaction is required beyond a standard form submission.

Compliance Impact

This vulnerability could lead to severe compliance violations. Exposure of server configuration and environment variables may breach data protection requirements under GDPR and HIPAA. Unauthorized access to application source code or remote code execution could result in unauthorized data access, processing, or disclosure, triggering mandatory breach notifications and potential regulatory penalties.

Mitigation Strategies

Update to versions 10.9.3, 12.6.1, or 13.2.1 immediately. If updates are unavailable, disable the sender_name field configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart