CVE-2026-77138: CWE-502 Deserialization of Untrusted Data in TYPO3 Extension "HTML5 Video Player vs. Powermail"

CVE-2026-77138 is a CWE-502 deserialization of untrusted data vulnerability in the TYPO3 extension "HTML5 Video Player vs. Powermail". The extension directly passes attacker-controlled cookie data to PHP's unserialize() function without proper validation or sanitization. This flaw allows remote, unauthenticated attackers to supply crafted serialized payloads that trigger PHP Object Injection, leading to remote code execution on the TYPO3 server. The vulnerability affects versions up to and including 0.2.1. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code on the TYPO3 server, potentially compromising the entire system. This can lead to full server takeover, data theft, or further network compromise. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the vulnerable extension "HTML5 Video Player vs. Powermail" if possible. Avoid exposing the TYPO3 installation to untrusted networks or users who could supply malicious cookies. Monitor for updates from the TYPO3 project regarding a security patch.