CVE-2026-77129: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine in TYPO3 Extension "Event management and registration"
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.
AI Analysis
Technical Summary
The TYPO3 extension "Event management and registration" improperly handles an editor-configurable email subject string by passing it directly into a Fluid template source without restrictions. This allows a backend user with edit access to inject Fluid ViewHelper syntax, potentially disclosing sensitive data or executing TypoScript content objects. The vulnerability requires authenticated backend access with edit privileges. Affected versions include multiple releases from version 6.0.0 up to but not including certain fixed versions, as well as versions below 5.9.3. No official remediation or patch is currently documented.
Potential Impact
An authenticated backend user with edit access to the event registration plugin or backend module can exploit this vulnerability to disclose sensitive information or execute arbitrary TypoScript content objects. This could lead to unauthorized data exposure or manipulation within the TYPO3 environment. The vulnerability does not require UI interaction but does require at least low privileges (edit access) in the backend.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user permissions to trusted users only and avoid granting edit access to the event plugin or backend module to untrusted accounts.
CVE-2026-77129: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine in TYPO3 Extension "Event management and registration"
Description
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.
CVSS v4.0
Score 7.7high
Affected software
pkg:composer/derhansen/sf_event_mgtRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The TYPO3 extension "Event management and registration" improperly handles an editor-configurable email subject string by passing it directly into a Fluid template source without restrictions. This allows a backend user with edit access to inject Fluid ViewHelper syntax, potentially disclosing sensitive data or executing TypoScript content objects. The vulnerability requires authenticated backend access with edit privileges. Affected versions include multiple releases from version 6.0.0 up to but not including certain fixed versions, as well as versions below 5.9.3. No official remediation or patch is currently documented.
Potential Impact
An authenticated backend user with edit access to the event registration plugin or backend module can exploit this vulnerability to disclose sensitive information or execute arbitrary TypoScript content objects. This could lead to unauthorized data exposure or manipulation within the TYPO3 environment. The vulnerability does not require UI interaction but does require at least low privileges (edit access) in the backend.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user permissions to trusted users only and avoid granting edit access to the event plugin or backend module to untrusted accounts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TYPO3
- Date Reserved
- 2026-08-20T13:10:12.062Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8d5b63acd9273b49f3656c
Added to database: 08/25/2026, 09:07:47 UTC
Last enriched: 08/25/2026, 09:24:03 UTC
Last updated: 08/25/2026, 23:53:26 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.