Skip to content

Releases: Shentao83/powermail-7.5-security-backport

Powermail 7.5.2 Security Backport

Choose a tag to compare

@Shentao83 Shentao83 released this 25 Aug 13:19

Unofficial security backport for Powermail 7.5.x.

This release mitigates CVE-2026-77136 / TYPO3-EXT-SA-2026-022,
a Fluid server-side template injection in mail-header processing.

Changes:

  • Prevent visitor-controlled sender and receiver header values from being evaluated as Fluid.
  • Keep configured Fluid usage for mail subjects and configured sender/receiver values.
  • Update extension version to 7.5.2.

Compatibility:

  • No database migration or form changes are required.
  • Existing sender_name fields and markers remain supported.
  • This is an unofficial legacy backport and not a replacement for upgrading to a supported Powermail version.