CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

CVSS

No CVSS.

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2026-022

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) La extensión pasa el valor en bruto de un campo de formulario configurado como 'Este campo contiene el nombre del remitente' directamente a una Vista Fluid como fuente de plantilla, sin ninguna sanitización, y lo renderiza. Un usuario anónimo, no autenticado, puede enviar sintaxis de plantilla Fluid en ese campo para ejecutar ViewHelpers Fluid arbitrarios, lo que lleva a la divulgación de la configuración del servidor, variables de entorno y código fuente de la aplicación, y potencialmente ejecución remota de código. La explotación requiere solo que un campo de formulario esté configurado como el campo sender_name, una configuración común y adyacente por defecto de Powermail. No se requiere autenticación ni interacción del usuario más allá de un envío de formulario normal. Se informa que esta vulnerabilidad está siendo explotada activamente en la naturaleza.

Information

Published : 2026-08-25 09:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-77136

Mitre link : CVE-2026-77136

CVE.ORG link : CVE-2026-77136

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-77136", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77136", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T14:06:57.264463Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"repo": "https://github.com/in2code-de/powermail", "vendor": "TYPO3", "product": "Extension \"powermail\"", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.2.1", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "12.6.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "10.9.3", "versionType": "semver"}], "packageName": "in2code/powermail", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T09:17:34.187", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-022", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild."}, {"lang": "es", "value": "La extensi\u00f3n pasa el valor en bruto de un campo de formulario configurado como 'Este campo contiene el nombre del remitente' directamente a una Vista Fluid como fuente de plantilla, sin ninguna sanitizaci\u00f3n, y lo renderiza. Un usuario an\u00f3nimo, no autenticado, puede enviar sintaxis de plantilla Fluid en ese campo para ejecutar ViewHelpers Fluid arbitrarios, lo que lleva a la divulgaci\u00f3n de la configuraci\u00f3n del servidor, variables de entorno y c\u00f3digo fuente de la aplicaci\u00f3n, y potencialmente ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n requiere solo que un campo de formulario est\u00e9 configurado como el campo sender_name, una configuraci\u00f3n com\u00fan y adyacente por defecto de Powermail. No se requiere autenticaci\u00f3n ni interacci\u00f3n del usuario m\u00e1s all\u00e1 de un env\u00edo de formulario normal. Se informa que esta vulnerabilidad est\u00e1 siendo explotada activamente en la naturaleza."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}