CVE-2026-77138
Received Received - Intake

PHP Object Injection in TYPO3 Extension

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: TYPO3

Description
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-77138
EUVD
EUVD-2026-65338

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
typo3 typo3 *
typo3 html5_video_player_vs_powermail to 0.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution flaw in the TYPO3 extension 'HTML5 Video Player vs.Powermail'. It occurs because the extension does not safely handle untrusted client input from attacker-controlled cookies. The input is directly passed to PHP's unserialize() function, allowing an attacker to inject a malicious serialized payload. This triggers PHP Object Injection, which can lead to arbitrary code execution on the TYPO3 server.

Detection Guidance

Check for the presence of the vulnerable extension 'HTML5 Video Player vs.Powermail' (html5videoplayer_powermail) in your TYPO3 installation. Inspect cookies for suspicious serialized payloads or unexpected input in the affected parameter. Review server logs for unserialize() function calls with untrusted data.

Impact Analysis

If you are using a vulnerable version of the 'HTML5 Video Player vs.Powermail' extension (0.2.1 or below), an unauthenticated remote attacker could exploit this flaw to execute arbitrary code on your TYPO3 server. This could allow the attacker to take full control of your server, steal data, or perform other malicious actions.

Compliance Impact

This vulnerability could lead to a data breach, exposing sensitive user data. For GDPR, this may result in significant fines due to unauthorized access to personal data. For HIPAA, it could violate safeguards for protected health information, leading to penalties and reputational damage.

Mitigation Strategies

Uninstall the 'HTML5 Video Player vs.Powermail' extension immediately. Delete the extension folder from your TYPO3 installation. Replace it with an alternative extension from the TYPO3 Extension Repository. Monitor for signs of compromise such as unexpected code execution or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart