CVE-2026-77138

Name of the Vulnerable Software and Affected Versions HTML5 Video Player vs. Powermail (html5videoplayer powermail) (affected versions not specified)

Description The extension fails to safely process untrusted client input from an attacker-controlled cookie passed directly to the PHP unserialize() function. This allows a remote, unauthenticated attacker to provide a crafted serialized payload to trigger PHP Object Injection, which can lead to Remote Code Execution on the TYPO3 server. PHP Object Injection is a vulnerability that occurs when untrusted input is used to instantiate objects, potentially allowing the attacker to manipulate the application logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.