CVE-2026-8727
HighSummary
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server.
Risk Assessment
Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This could lead to serious security breaches in the system.
Recommendation
It is recommended to restrict access to crawling features and to monitor and update the Crawler extension to minimize the risk of exploitation of this vulnerability.
Original NVD description (English source)
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.