Unofficial security backport for Powermail 7.5.x.
This release mitigates CVE-2026-77136 / TYPO3-EXT-SA-2026-022,
a Fluid server-side template injection in mail-header processing.
Changes:
- Prevent visitor-controlled sender and receiver header values from being evaluated as Fluid.
- Keep configured Fluid usage for mail subjects and configured sender/receiver values.
- Update extension version to 7.5.2.
Compatibility:
- No database migration or form changes are required.
- Existing
sender_namefields and markers remain supported. - This is an unofficial legacy backport and not a replacement for upgrading to a supported Powermail version.