CVE-2026-77129
High
Description
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Extension "Event management and registration"
PublishedAug 25, 2026
First seenAug 25, 2026
Weakness typeCWE-1336CWE-1336
How to fix
Update
- TYPO3 Extension "Event management and registration"9.0.3, 8.6.2, 7.9.3, 6.7.2, 5.9.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TYPO3 Extension "Event management and registration" | 9.0.0 ≤ v < 9.0.3, 8.0.0 ≤ v < 8.6.2, 7.0.0 ≤ v < 7.9.3, 6.0.0 ≤ v < 6.7.2, v < 5.9.3 | 9.0.3, 8.6.2, 7.9.3, 6.7.2, 5.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.