PT-2026-41867 · Typo3 · Crawler Extension

Roman Hergenreder · Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-8727

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TYPO3 Crawler extension (affected versions not specified)

Description The Crawler extension is subject to Remote Code Execution via PHP Object Injection. This occurs because the extension passes the "X-T3Crawler-Meta" response header from crawled URLs directly to the PHP unserialize() function. An attacker who controls a crawled endpoint can inject arbitrary serialized PHP objects to execute code on the server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl through a Scheduler task.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-8727

Affected Products

Crawler Extension

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8727 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2026-008 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2056691704984473623 · Twitter Post
• https://t.me/CVEtracker/54232 · Telegram Post