CVE-2026-77136: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine in TYPO3 Extension "powermail"

The TYPO3 extension "powermail" improperly neutralizes special elements used in its Fluid template engine. Specifically, it passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source without sanitization. An unauthenticated attacker can submit Fluid template syntax in this field, leading to arbitrary Fluid ViewHelpers execution. This can disclose server configuration, environment variables, application source code, and potentially allow remote code execution. The vulnerability requires only that the form field is configured as sender_name, which is common or default-adjacent in Powermail configurations. The issue affects versions 11.0.0, 13.0.0, and ranges >=11.0.0 <12.6.1 and >=13.0.0 <13.2.1, as well as versions below 10.9.3. No official patch or remediation level is currently documented.

An unauthenticated attacker can exploit this vulnerability by submitting specially crafted input in a form field to execute arbitrary Fluid ViewHelpers. This can lead to disclosure of sensitive server configuration, environment variables, and application source code. Additionally, it may enable remote code execution, posing a critical risk to affected systems. The vulnerability is actively exploited in the wild, increasing the urgency of mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring form fields as "sender_name" in Powermail or restrict input to trusted users. Monitor vendor communications for updates on patches or official mitigations.