Powermail CVE-2026-77136

The concrete prerequisite is that a Powermail form has at least one field configured with the 'This field contains the name of the sender' (sender_name) marker - the description states this is a common, default-adjacent Powermail configuration. Given that field exists, exploitation needs only a normal anonymous form submission: no authentication, no privileges, and no user interaction beyond submitting the form (PR:N/UI:N). The limiting factors are therefore: (1) the site must run the Powermail extension, (2) a reachable form must map a field to the sender_name role, and (3) the form endpoint must be network-accessible to the attacker. Sites that use Powermail but never assign the sender_name field marker are not exploitable via this path.

This is a genuine high-priority issue rather than a paper-tiger high CVSS. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) describes network-reachable, unauthenticated, low-complexity exploitation with full confidentiality, integrity and availability impact extending beyond the vulnerable component - consistent with SSTI escalating to RCE. The only tempering signal is AT:P (an attack requirement): a form field must be configured as the sender_name field; the description characterizes this as common and default-adjacent, so it excludes few real deployments. The vendor reports active in-the-wild exploitation, which - even though this CVE is not confirmed on the CISA KEV list in the provided data - sharply raises urgency; any operator running a public-facing Powermail form should treat patching as immediate. No EPSS score, POC reference, or SSVC decision was supplied, so exploitation probability cannot be quantified independently, but the combination of unauthenticated network reach, a public vendor advisory, and reported exploitation makes waiting for those metrics unwise.

An anonymous attacker locates a public TYPO3 site whose Powermail contact form has a field designated as the sender name, then submits the form with that field containing a Fluid expression instead of a name. The server compiles the field value as template source and executes the embedded ViewHelpers, returning environment variables and configuration or, where suitable ViewHelpers are reachable, running attacker-supplied commands. The vendor reports this technique is already being exploited in the wild; low complexity and no authentication make it trivially scriptable against exposed forms.