The TYPO3 powermail extension improperly passes the raw value of a form field designated as the sender's name directly into a Fluid View template source without sanitization. This allows an anonymous, unauthenticated attacker to submit Fluid template syntax that executes arbitrary Fluid ViewHelpers. The impact includes disclosure of server configuration, environment variables, application source code, and potentially remote code execution. The vulnerability affects versions =13.0.0, =11.0.0, >=13.0.0 <13.2.1, >=11.0.0 <12.6.1, and <10.9.3. No authentication or special user interaction beyond form submission is required. The vulnerability is actively exploited in the wild and has a CVSS 4.0 score of 9.5 (critical).

An attacker can exploit this vulnerability to execute arbitrary Fluid ViewHelpers by injecting Fluid template syntax in a form field, leading to disclosure of sensitive server configuration, environment variables, and application source code. This may also enable remote code execution. The vulnerability requires no authentication and can be triggered by submitting a specially crafted form input. The high CVSS score and active exploitation indicate a severe risk to affected TYPO3 powermail installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring form fields as the sender_name field or restrict input to trusted users. Monitor vendor communications for patches or temporary mitigations. Do not rely on generic mitigations as the vulnerability specifically involves unsanitized template rendering.