AIKIDO-2026-802492

in2code/powermail is vulnerable to Server-Side Template Injection (SSTI)

Server-Side Template Injection (SSTI)CVE-2026-77136 Published 2 days ago

Critical Risk

This Affects:

in2code/powermail

3.4.0 - 10.9.2

Fixed in 10.9.3

11.0.0 - 12.6.0

Fixed in 12.6.1

13.0.0 - 13.2.0

Fixed in 13.2.1

Are you affected? Scan for Free

TL;DR

The extension renders the submitted value of a form field configured as the sender name (and similar sender fields) as Fluid template source without sanitization. Someone submitting a normal form can inject Fluid template syntax and invoke arbitrary ViewHelpers, exposing server configuration, environment variables, and application source, and potentially executing arbitrary code. The parsing happens without authentication and without any ViewHelper allowlist. The fix restricts frontend Fluid parsing to configured keys, allowlists namespaces and ViewHelpers, neutralizes unsafe modifiers, and removes persistent caching of visitor-controlled templates.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your forms use a field configured as the sender name (or a comparable sender field) whose submitted value is rendered through Fluid.