PT-2026-41865 · Typo3 · Typo3 Extension

Matthias Mächler + 1 · Published 2026-05-19 · Updated 2026-05-25 · CVE-2026-46725

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Content Element Selector (ceselector) (affected versions not specified)

Description The extension passes an attacker-controlled cookie directly to the unserialize() function without safe processing. A remote, unauthenticated attacker can provide a crafted serialized payload to trigger PHP Object Injection, which allows for Remote Code Execution on the server. This issue occurs when the content element is configured with "Persistent Mode: Static" in the plugin settings. PHP Object Injection is a technique where untrusted input is used to manipulate the way an application reconstructs objects from a stored format, potentially allowing the execution of arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-46725

Affected Products

Typo3 Extension

References · 8

• https://typo3.org/security/advisory/typo3-ext-sa-2026-013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46725 · Security Note
• https://twitter.com/CCBalert/status/2057374397455851840 · Twitter Post
• https://twitter.com/autumn_good_35/status/2057484073891950599 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2058726997615145034 · Twitter Post
• https://twitter.com/fofabot/status/2058750836730458395 · Twitter Post
• https://t.me/CVEtracker/54230 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056696824660979865 · Twitter Post