The TYPO3 extension "HTML5 Video Player vs. Powermail" improperly processes untrusted client input from an attacker-controlled cookie by passing it directly to PHP's unserialize() function. This unsafe deserialization (CWE-502) enables a remote, unauthenticated attacker to supply a crafted serialized payload that triggers PHP Object Injection. Successful exploitation can lead to Remote Code Execution on the TYPO3 server. The vulnerability affects all versions up to 0.2.1 inclusive. There is no vendor advisory or patch information currently available to confirm remediation status.

An attacker can remotely execute arbitrary code on the TYPO3 server without authentication by exploiting unsafe deserialization of attacker-controlled cookie data. This can lead to full system compromise, data breach, or service disruption. The CVSS 4.0 base score is 9.3 (critical), reflecting the high impact and ease of exploitation with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected extension if possible to mitigate risk.