Executive brief
The TYPO3 Event Management and Registration extension allows backend administrators to configure email notification templates. A backend user with plugin edit permissions can inject Fluid template syntax into the email subject field, leading to disclosure of sensitive server data, environment variables, and application source code. In some cases, this could enable remote code execution through TypoScript content objects.
Technical details
The vulnerability is a Server-Side Template Injection (SSTI) flaw in the email subject handling mechanism. The extension passes user-supplied editor configuration directly into a Fluid template source without sanitization or escaping. An authenticated backend user with edit access to the event registration plugin or backend module can inject Fluid ViewHelper syntax (e.g., {f:debug()} or TypoScript objects) into the configurable email subject string. This is executed server-side when emails are generated, allowing disclosure of sensitive configuration, environment variables, and source code. Patched versions (5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3) are available and should be applied immediately.
Affected products
- TYPO3 sf_event_mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Patched versions 5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3 released