Deserialization in TYPO3 Extension "Html5 Video Player Vs. Powermail"

CVE-2026-77138

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

Vulnerability class: Insecure Deserialization

EPSS: 0.004 (35.0th percentile) — read the EPSS interpretation.