CVE-2026-77138: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it. The attack is network-reachable and does not require user interaction or prior privileges.
What must an attacker send to trigger the vulnerability?
The attacker must provide a crafted serialized payload through an attacker-controlled cookie. The vulnerable extension passes this untrusted cookie data directly to PHP's unserialize() function.
What is the likely impact if exploitation succeeds?
Successful exploitation can trigger PHP Object Injection and lead to remote code execution on the TYPO3 server. The reported impact includes high confidentiality, integrity, and availability effects.