# CVE-2026-77138: TYPO3 HTML5 Video Player vs. Powermail extension remote code execution

Source: https://junglewise.ai/threats/cve-2026-77138-typo3-html5-video-player-vs-powermail-extension-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77138 · Severity: info · CVSS 9.8 · Published 2026-08-25

The "HTML5 Video Player vs. Powermail" extension for TYPO3 improperly deserializes untrusted cookie data without validation, allowing an unauthenticated attacker to inject malicious serialized objects. An attacker can exploit this vulnerability to achieve arbitrary code execution on the web server, gaining complete control over the TYPO3 installation and any data it manages.

Vendors: [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-77138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77138 being exploited in the wild.

**How severe is CVE-2026-77138?** Informational severity, with a CVSS score of 9.8, published 25 August 2026.

**Which products and versions are affected?** Typo3 HTML5 Video Player vs. Powermail extension 0.2.1 and below.

**Is there a fix for CVE-2026-77138?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77138 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77138?** Check whether you run Typo3 HTML5 Video Player vs. Powermail extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP Object Injection issue (CWE-502) caused by passing attacker-controlled cookie input directly to PHP's unserialize() function without sanitization or validation. An unauthenticated remote attacker with network access can craft a malicious serialized payload and deliver it via a cookie header to trigger object instantiation gadget chains, achieving Remote Code Execution. The vulnerable component processes untrusted client input during the deserialization step with no access control required. The extension (lochmueller/html5videoplayer-powermail) has been deprecated and is no longer maintained; affected versions 0.2.1 and below have been removed from the TYPO3 Extension Repository.

## Affected products

- TYPO3 HTML5 Video Player vs. Powermail extension 0.2.1 and below

## Timeline

- 2026-08-25: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-014](https://typo3.org/security/advisory/typo3-ext-sa-2026-014)