EUVD-2026-65340
GHSA-6956-f2gq-2c74
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSTI (PR:N/UI:N/AC:L); template engine reaches OS/config beyond the app so S:C, with full C/I/A impact from disclosure and potential RCE.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.
AnalysisAI
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is that a Powermail form has at least one field configured with the 'This field contains the name of the sender' (sender_name) marker - the description states this is a common, default-adjacent Powermail configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a paper-tiger high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An anonymous attacker locates a public TYPO3 site whose Powermail contact form has a field designated as the sender name, then submits the form with that field containing a Fluid expression instead of a name. The server compiles the field value as template source and executes the embedded ViewHelpers, returning environment variables and configuration or, where suitable ViewHelpers are reachable, running attacker-supplied commands. … |
| Remediation | Apply the fixed Powermail release identified in TYPO3 advisory TYPO3-EXT-SA-2026-022 (https://typo3.org/security/advisory/typo3-ext-sa-2026-022); the input does not include an exact fix version, so retrieve it from that advisory rather than relying on a guessed number - patch available per vendor advisory, released patched version not independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate (24 hours): Identify all systems running TYPO3 Powermail extension and assess internet exposure; establish incident response plan for extension disablement. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directive
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
Share
External POC / Exploit Code
Leaving vuln.today