Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-77138

Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "HTML5 Video Player vs. Powermail"

Default version status: unaffected

  • 0 to ≤ 0.2.1affected

References