The vulnerability arises when the powermail extension forwards the raw contents of a form field configured as the sender_name directly to a Fluid view as template source. The absence of sanitization allows an attacker to submit arbitrary Fluid syntax, enabling the execution of arbitrary ViewHelpers. An unauthenticated, anonymous user can thus trigger disclosure of server configuration, environment variables, source code, and potentially execute remote code on the host.

TYPO3 installations that use the powermail extension are affected. The issue applies to all versions of the powermail extension that lack the patch against CVE-2026-77136. The vulnerable configuration requires the form field named sender_name to be present, a setting that is common and enabled by default in many powermail setups.

The CVSS score of 9.5 indicates critical severity. EPSS is not available, but reports confirm the vulnerability is actively exploited in the wild. Because the flaw can be triggered by a simple web form submission, the attack vector is web‑based, and no authentication is required. The vulnerability is not listed in the CISA KEV catalog, yet its active exploitation underscores the need for prompt remediation.