Most recent entries from all

EUVD-2026-319423

fkie_cve-2026-8727

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

GHSA-jr8m-x4p7-p3v5 — TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

Affected: Packagist: tomasnorre/crawler

The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's `unserialize()`. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.

WID-SEC-W-2026-1585 — TYPO3 Extensions: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.