CVE-2026-77138 — Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

CVE-2026-77138

Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) PUBLISHED

Description (CNA)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "HTML5 Video Player vs. Powermail"	affected 0 through 0.2.1

CWE

CWE-502

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-014

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.