Marcus Schwemer

**Name of the Vulnerable Software and Affected Versions** TYPO3 Powermail (affected versions not specified) **Description** An issue exists where the extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as a template source without sanitization. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers, which may lead to the disclosure of server configuration, environment variables, and application source, and potentially result in remote code execution. This issue is reported to be actively exploited in the wild. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.