Unauthenticated Fluid template injection in TYPO3 powermail forms enables RCE (CVE-2026-77136)
The TYPO3 security team's advisory published today confirms active in-the-wild exploitation and urges immediate updates — sites leaving a public Powermail contact form unpatched this week face secrets disclosure and likely server compromise.
The TYPO3 powermail extension renders the raw value of a form field configured as the sender name as a Fluid template, so an anonymous visitor submitting a normal contact form can execute arbitrary Fluid ViewHelpers — disclosing server configuration, environment variables and source code, and potentially achieving remote code execution. The vulnerable sender_name configuration is common and default-adjacent.
Affected: TYPO3 extension powermail < 10.9.3; TYPO3 extension powermail >= 11.0.0, < 12.6.1; TYPO3 extension powermail >= 13.0.0, < 13.2.1
How to Test
Search the tx_powermail_domain_model_mail database table and received form notification emails for Fluid syntax in the sender_name field — strings like 'f:', 'v:' or 'namespace' indicate attempted or successful ViewHelper execution; per the advisory, treat any system with such entries as potentially compromised and investigate before simply patching.
How to Patch
Update powermail to 10.9.3, 12.6.1 or 13.2.1 via the TYPO3 extension manager, Packagist or the extensions.typo3.org downloads; if you cannot update immediately, remove or reconfigure the sender_name field mapping on public forms as an interim mitigation, and rotate exposed environment secrets on any site showing Fluid syntax in stored submissions.