Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)

published 2026-08-25 2 mo ago modified 2026-08-26 2 mo ago also EUVD-2026-65346

cvss: 7.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits: 0; none known

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.

Patch / fix

fixed in 1

TYPO3 Extension "Event management and registration" 5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-08-25)

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

TYPO3 Extension "Event management and registration"

Classification

Weakness

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References

typo3.org /security/advisory/typo3-ext-sa-2026-023
vendor-advisory

Sources

CVE List CVE-2026-77129
NVD CVE-2026-77129

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary