Do Son 
TYPO3 developers recently patched a critical TYPO3 Powermail RCE flaw that attackers are exploiting in the wild. Additionally, they warned users about a separate insecure deserialization vulnerability in the deprecated HTML5 Video Player extension. Therefore, website administrators must immediately update or remove these tools to secure their servers.
Why These Vulnerabilities Matter
These vulnerabilities expose TYPO3 web servers to complete system compromise. Specifically, CVE-2026-77136 poses an extreme risk because hackers are currently exploiting it. The official advisory warns that this TYPO3 Powermail RCE flaw allows an anonymous user to execute arbitrary commands. Consequently, attackers can easily trigger the “disclosure of server configuration, environment variables and application source.” While exact installation numbers remain unconfirmed, Powermail is a highly popular TYPO3 form extension.
How the Attacks Work
CVE-2026-77136: Powermail SSTI
The Server-Side Template Injection flaw occurs when administrators enable the “This field contains the name of the sender” option. The extension passes this raw value directly into a Fluid View without proper sanitization. As a result, an unauthenticated attacker simply submits Fluid template syntax within that field. The server then executes these arbitrary Fluid ViewHelpers. The security advisory confirm “This vulnerability is reported to be actively exploited in the wild.”
CVE-2026-77138: Insecure Deserialization
Conversely, CVE-2026-77138 affects the HTML5 Video Player plugin. The extension fails to safely process untrusted client input. Attackers manipulate a specific cookie value that PHP parses via the unserialize() function. This action triggers a PHP Object Injection, which eventually leads to remote code execution.
Affected Versions and Mitigation Steps
The active TYPO3 Powermail RCE flaw impacts versions 10.9.2 and below, 11.0.0 through 12.6.0, and 13.0.0 through 13.2.0. To fix this issue, administrators must install version 10.9.3, 12.6.1, or 13.2.1. If you cannot update immediately, you must disable the “This field contains the name of the sender” configuration. The developers urge users to update Powermail immediately.
Meanwhile, the HTML5 Video Player vulnerability affects version 0.2.1 and below. Because this extension is outdated and unmaintained, no patch exists. You must uninstall and delete the extension folder completely.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
