Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77129Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)

High 7.7

In plain English

A high-severity security flaw in Extension "Event management and registration" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Event management and registration"	9.0.0 – before 9.0.38.0.0 – before 8.6.27.0.0 – before 7.9.36.0.0 – before 6.7.20 – before 5.9.3

Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-023 vendor-advisory