CVE-2026-77129

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An extension allows an editor-configurable email subject string to be passed directly into a Fluid template source without restriction. An authenticated backend user with edit access to the event registration plugin or backend module can inject Fluid ViewHelper syntax into this field. This can lead to the disclosure of sensitive data or the execution of TypoScript content objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.