Is CVE-2026-77136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77136 being exploited in the wild.

How severe is CVE-2026-77136?

Informational severity, with a CVSS score of 8.6, published 25 August 2026.

Which products and versions are affected?

In2code Powermail 10.9.2 and below, 11.0.0 - 12.6.0, 13.0.0 - 13.2.0.

Is there a fix for CVE-2026-77136?

A patch was published on 2026-08-25: Patched versions 10.9.3, 12.6.1, and 13.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77136 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77136?

Check whether you run In2code Powermail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77136: TYPO3 Powermail Server-Side Template Injection in sender field

CVE-2026-77136 · Severity: info · CVSS 8.6 · Published 2026-08-25

TYPO3's Powermail extension, a popular form-building plugin for the TYPO3 CMS, contains a critical flaw in how it processes form submission data. When a form field is configured to capture a sender's name, the extension directly uses that user input as template code without validation, allowing attackers to execute server-side commands. An attacker can craft a malicious form submission with template syntax to extract sensitive system information (configuration, environment variables, source code) or achieve remote code execution, with no authentication or special user interaction required beyond a normal form submission.

Vendors: In2code.

Quick answers

Is CVE-2026-77136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77136 being exploited in the wild.
How severe is CVE-2026-77136?: Informational severity, with a CVSS score of 8.6, published 25 August 2026.
Which products and versions are affected?: In2code Powermail 10.9.2 and below, 11.0.0 - 12.6.0, 13.0.0 - 13.2.0.
Is there a fix for CVE-2026-77136?: A patch was published on 2026-08-25: Patched versions 10.9.3, 12.6.1, and 13.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77136 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77136?: Check whether you run In2code Powermail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Template Injection (SSTI) in TYPO3 Powermail's handling of the sender_name form field. The extension passes raw user input directly into a Fluid View template without sanitization, and renders it as template source code. This allows unauthenticated attackers to submit Fluid template syntax (e.g., custom ViewHelpers with v: or f: namespace directives) in the sender_name field to execute arbitrary ViewHelpers, leading to disclosure of server configuration, environment variables, application source, and potentially remote code execution. Exploitation requires only that the form field is configured as "sender_name"—a common, default-adjacent configuration—and no authentication is necessary. The vulnerability has been actively exploited in the wild; patched versions (10.9.3, 12.6.1, 13.2.1) are available.

Affected products

in2code Powermail 10.9.2 and below, 11.0.0 - 12.6.0, 13.0.0 - 13.2.0

Timeline

2026-08-25: disclosed: CVE-2026-77136 published by TYPO3 security advisory
2026-08-25: exploited: Vulnerability reported to be actively exploited in the wild at time of disclosure
2026-08-25: patched: Patched versions 10.9.3, 12.6.1, and 13.2.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.