CVE-2026-77138
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The extension fails to safely process untrusted client input from an attacker-controlled cookie directly into PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Risk Assessment
An attacker can fully compromise the TYPO3 server, potentially leading to data theft, content modification, or use of the server for further attacks.
Recommendation
Immediately update the TYPO3 extension to a version that includes a fix for this vulnerability and check for signs of compromise.
Other vulnerabilities in TYPO3 extension
See all- CVE-2026-46725Critical
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
- CVE-2026-56092High
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
Original NVD description (English source)
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS