CVE-2026-77136

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77136", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2026-08-20T13:10:12.063Z", "datePublished": "2026-08-25T09:00:39.526Z", "dateUpdated": "2026-08-25T14:07:07.220Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-08-25T09:00:39.526Z"}, "title": "Server-Side Template Injection in extension \"powermail\" (powermail)", "datePublic": "2026-08-25T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "affected": [{"vendor": "TYPO3", "product": "Extension \"powermail\"", "collectionURL": "https://packagist.org/", "packageName": "in2code/powermail", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.2.1", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "12.6.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "10.9.3", "versionType": "semver"}], "defaultStatus": "unaffected", "repo": "https://github.com/in2code-de/powermail"}], "descriptions": [{"lang": "en", "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the <code>sender_name</code> field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild."}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-022", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Antariksha Sharma", "type": "reporter"}, {"lang": "en", "value": "R\u00e9mi Payette", "type": "reporter"}, {"lang": "en", "value": "Office qu\u00e9b\u00e9cois de la langue fran\u00e7aise (OQLF)", "type": "reporter"}, {"lang": "en", "value": "Centre gouvernemental de Cyberd\u00e9fense (CGCD)", "type": "reporter"}, {"lang": "en", "value": "Marcus Schwemer", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T14:06:57.264463Z", "id": "CVE-2026-77136", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:07:07.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77136", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T14:06:57.264463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:07:01.389Z"}}], "cna": {"title": "Server-Side Template Injection in extension \"powermail\" (powermail)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Antariksha Sharma"}, {"lang": "en", "type": "reporter", "value": "R\u00e9mi Payette"}, {"lang": "en", "type": "reporter", "value": "Office qu\u00e9b\u00e9cois de la langue fran\u00e7aise (OQLF)"}, {"lang": "en", "type": "reporter", "value": "Centre gouvernemental de Cyberd\u00e9fense (CGCD)"}, {"lang": "en", "type": "remediation developer", "value": "Marcus Schwemer"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/in2code-de/powermail", "vendor": "TYPO3", "product": "Extension \"powermail\"", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.2.1", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "12.6.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "10.9.3", "versionType": "semver"}], "packageName": "in2code/powermail", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-25T09:00:00.000Z", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-022", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.", "supportingMedia": [{"type": "text/html", "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the <code>sender_name</code> field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-08-25T09:00:39.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77136", "state": "PUBLISHED", "dateUpdated": "2026-08-25T14:07:07.220Z", "dateReserved": "2026-08-20T13:10:12.063Z", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "datePublished": "2026-08-25T09:00:39.526Z", "assignerShortName": "TYPO3"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/", "defaultStatus": "unaffected", "packageName": "in2code/powermail", "product": "Extension \"powermail\"", "repo": "https://github.com/in2code-de/powermail", "vendor": "TYPO3", "versions": [{"lessThan": "13.2.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "12.6.1", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "10.9.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild."}, {"lang": "es", "value": "La extensi\u00f3n pasa el valor en bruto de un campo de formulario configurado como 'Este campo contiene el nombre del remitente' directamente a una Vista Fluid como fuente de plantilla, sin ninguna sanitizaci\u00f3n, y lo renderiza. Un usuario an\u00f3nimo, no autenticado, puede enviar sintaxis de plantilla Fluid en ese campo para ejecutar ViewHelpers Fluid arbitrarios, lo que lleva a la divulgaci\u00f3n de la configuraci\u00f3n del servidor, variables de entorno y c\u00f3digo fuente de la aplicaci\u00f3n, y potencialmente ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n requiere solo que un campo de formulario est\u00e9 configurado como el campo sender_name, una configuraci\u00f3n com\u00fan y adyacente por defecto de Powermail. No se requiere autenticaci\u00f3n ni interacci\u00f3n del usuario m\u00e1s all\u00e1 de un env\u00edo de formulario normal. Se informa que esta vulnerabilidad est\u00e1 siendo explotada activamente en la naturaleza."}], "id": "CVE-2026-77136", "lastModified": "2026-09-28T23:10:00.143", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77136", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T14:06:57.264463Z", "version": "2.0.3"}}]}, "published": "2026-08-25T09:17:34.187", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-022"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}

{}

{"created": "2026-08-25T10:45:03.469768+00:00", "updated": "2026-08-25T10:45:03.469782+00:00", "vendors": []}