TYPO3 PHP Object Injection via Untrusted Cookie (RCE)
CVE-2026-77138 Published on August 25, 2026

Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-77138 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-77138 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.


Affected Versions

TYPO3 Extension "HTML5 Video Player vs. Powermail":