# CVE-2026-77129: TYPO3 sf_event_mgt Server-Side Template Injection in email subject

Source: https://junglewise.ai/threats/cve-2026-77129-typo3-sf-event-mgt-server-side-template-injection-in-email  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77129 · Severity: info · CVSS 7.1 · Published 2026-08-25

The TYPO3 Event Management and Registration extension allows backend administrators to configure email notification templates. A backend user with plugin edit permissions can inject Fluid template syntax into the email subject field, leading to disclosure of sensitive server data, environment variables, and application source code. In some cases, this could enable remote code execution through TypoScript content objects.

Vendors: [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-77129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77129 being exploited in the wild.

**How severe is CVE-2026-77129?** Informational severity, with a CVSS score of 7.1, published 25 August 2026.

**Which products and versions are affected?** Typo3 Sf Event Mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2.

**Is there a fix for CVE-2026-77129?** A patch was published on 2026-08-25: Patched versions 5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77129 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77129?** Check whether you run Typo3 Sf Event Mgt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Template Injection (SSTI) flaw in the email subject handling mechanism. The extension passes user-supplied editor configuration directly into a Fluid template source without sanitization or escaping. An authenticated backend user with edit access to the event registration plugin or backend module can inject Fluid ViewHelper syntax (e.g., {f:debug()} or TypoScript objects) into the configurable email subject string. This is executed server-side when emails are generated, allowing disclosure of sensitive configuration, environment variables, and source code. Patched versions (5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3) are available and should be applied immediately.

## Affected products

- TYPO3 sf_event_mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched: Patched versions 5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3 released

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-023](https://typo3.org/security/advisory/typo3-ext-sa-2026-023)

## Related threats

- [TYPO3 sf_event_mgt broken access control on event visibility](https://junglewise.ai/threats/cve-2026-77128-typo3-sf-event-mgt-broken-access-control-on-event-visibility)