Executive brief
TYPO3's Powermail extension, a popular form-building plugin for the TYPO3 CMS, contains a critical flaw in how it processes form submission data. When a form field is configured to capture a sender's name, the extension directly uses that user input as template code without validation, allowing attackers to execute server-side commands. An attacker can craft a malicious form submission with template syntax to extract sensitive system information (configuration, environment variables, source code) or achieve remote code execution, with no authentication or special user interaction required beyond a normal form submission.
Technical details
The vulnerability is a Server-Side Template Injection (SSTI) in TYPO3 Powermail's handling of the sender_name form field. The extension passes raw user input directly into a Fluid View template without sanitization, and renders it as template source code. This allows unauthenticated attackers to submit Fluid template syntax (e.g., custom ViewHelpers with v: or f: namespace directives) in the sender_name field to execute arbitrary ViewHelpers, leading to disclosure of server configuration, environment variables, application source, and potentially remote code execution. Exploitation requires only that the form field is configured as "sender_name"—a common, default-adjacent configuration—and no authentication is necessary. The vulnerability has been actively exploited in the wild; patched versions (10.9.3, 12.6.1, 13.2.1) are available.
Affected products
- in2code Powermail 10.9.2 and below, 11.0.0 - 12.6.0, 13.0.0 - 13.2.0
Timeline
- 2026-08-25: disclosed: CVE-2026-77136 published by TYPO3 security advisory
- 2026-08-25: exploited: Vulnerability reported to be actively exploited in the wild at time of disclosure
- 2026-08-25: patched: Patched versions 10.9.3, 12.6.1, and 13.2.1 released