CVE-2026-77138: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

Published Aug 25, 2026

Updated

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

Affected Software

1 affected component

TYPO3

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote, unauthenticated attacker can exploit it. The attack is network-reachable and does not require user interaction or prior privileges.

What must an attacker send to trigger the vulnerability?

The attacker must provide a crafted serialized payload through an attacker-controlled cookie. The vulnerable extension passes this untrusted cookie data directly to PHP's unserialize() function.

What is the likely impact if exploitation succeeds?

Successful exploitation can trigger PHP Object Injection and lead to remote code execution on the TYPO3 server. The reported impact includes high confidentiality, integrity, and availability effects.

CVE-2026-77138: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker send to trigger the vulnerability?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker send to trigger the vulnerability?

What is the likely impact if exploitation succeeds?