TYPO3 Extension Powermail vulnerabilities

2 CVEs affecting TYPO3 Extension Powermail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77136, published 2026-08-25.

More from TYPO3.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-77136, published 2026-08-25. Critical severity, CVSS 9.5. EPSS: 1% chance of exploitation in the next 30 days. The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it.…
• CVE-2025-7899, published 2025-07-22. Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days. The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and…