CVE-2026-46725
CriticalSummary
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to gain full control over the TYPO3 server, posing a serious security threat to the organization.
Recommendation
It is recommended to update the extension to the latest version and configure the content element with 'Persistent Mode: Static' disabled.
Other vulnerabilities in TYPO3 extension
See all- CVE-2026-77138Critical
The extension fails to safely process untrusted client input from an attacker-controlled cookie directly into PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
- CVE-2026-56092High
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
Original NVD description (English source)
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS