CVE-2026-77136: Powermail Extension RCE Vulnerability

CVE-2026-77136 Overview

CVE-2026-77136 is a server-side template injection (SSTI) vulnerability in the TYPO3 Powermail extension. The extension passes the raw value of a form field configured as the sender name directly into a Fluid View as template source. No sanitization is performed before rendering. An unauthenticated attacker can submit Fluid template syntax through a public form to execute arbitrary Fluid ViewHelpers. Successful exploitation discloses server configuration, environment variables, and application source code. The flaw can also lead to remote code execution on the underlying host. The vulnerability is classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Unauthenticated attackers submitting a Powermail form can inject Fluid template syntax to read sensitive server data and achieve remote code execution.

Affected Products

TYPO3 CMS Powermail extension (in2code/powermail)
Installations where a form field is configured as the sender_name field
Sites running default-adjacent Powermail contact form configurations

Discovery Timeline

2026-08-25 - CVE-2026-77136 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77136

Vulnerability Analysis

The Powermail extension for TYPO3 renders the sender name field value through the Fluid templating engine. The field value is treated as template source rather than as data. Fluid supports ViewHelpers that expose configuration, environment variables, and file system content. An attacker who submits a form containing Fluid syntax such as {...} expressions triggers ViewHelper execution during rendering. The rendered output may be reflected in confirmation pages, notification emails, or backend views. This exposes secrets held in TYPO3 configuration and PHP environment variables. Depending on the ViewHelpers available, attackers can chain calls to reach arbitrary code execution.

Root Cause

The root cause is a missing separation between template source and untrusted user input. The extension instantiates a Fluid StandaloneView and assigns the user-supplied sender name as the template source string. Fluid parses and evaluates the string, which converts data into executable template logic. This pattern maps directly to [CWE-1336], improper neutralization of template syntax.

Attack Vector

The attack requires only network access to a public Powermail form on an affected TYPO3 site. The attacker submits the form with Fluid syntax in the sender name field. No authentication, no session, and no user interaction beyond the submission are required. The public advisory reports active exploitation in the wild.

Refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-022 for the vendor description of the injection sink and affected code path.

Detection Methods for CVE-2026-77136

Indicators of Compromise

Form submissions where the sender name field contains Fluid syntax such as {, }, ->, or ViewHelper namespaces like f: or <f:
Powermail confirmation emails or backend records containing rendered Fluid output, environment variables, or configuration values
Outbound connections from the TYPO3 web server initiated shortly after Powermail form submissions
Unexpected PHP child processes spawned by the web server user after a Powermail POST request

Detection Strategies

Inspect web server access logs for POST requests to Powermail form endpoints containing URL-encoded {, %7B, or f%3A patterns in sender name parameters
Review Powermail tx_powermail_domain_model_mail database records for stored sender_name values containing template syntax
Correlate form submissions with web shell drops, cron modifications, or new files under the TYPO3 web root

Monitoring Recommendations

Enable request body logging on the reverse proxy or WAF for Powermail form URIs
Alert on any string matching \{[a-zA-Z0-9_:.\-> ]+\} in sender name fields
Monitor the web server process tree for shell interpreters (sh, bash, python) spawned by PHP-FPM

How to Mitigate CVE-2026-77136

Immediate Actions Required

Apply the fixed Powermail release referenced in the TYPO3 Security Advisory TYPO3-EXT-SA-2026-022 without delay
Audit all TYPO3 sites for Powermail forms that expose a sender_name-mapped field to unauthenticated users
Search Powermail submission tables and mail logs for stored payloads containing Fluid syntax
Rotate credentials, API keys, and secrets stored in TYPO3 configuration and environment variables on affected hosts

Patch Information

The TYPO3 project has published fixed versions of the Powermail extension in the vendor advisory. Update the in2code/powermail package to the fixed release through Composer or the TYPO3 Extension Manager. Verify that all TYPO3 project instances, including staging and disaster recovery replicas, are updated. Details and version numbers are listed in the TYPO3 Security Advisory TYPO3-EXT-SA-2026-022.

Workarounds

Temporarily disable or unpublish Powermail forms that map a public field to sender_name until patching is complete
Deploy a WAF rule that blocks Powermail POST bodies containing {f: or unbalanced {} sequences in the sender name parameter
Restrict access to affected forms behind authentication or IP allowlists during the remediation window

bash

# Configuration example: update Powermail via Composer
composer require in2code/powermail:"^<fixed-version-from-advisory>" --update-with-dependencies
vendor/bin/typo3 extension:setup
vendor/bin/typo3 cache:flush