VULNERABILITY INTELLIGENCE
CVE-2026-8727
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-05-19
Last modified2026-10-26
Description
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
Weakness classification
- f4fb688c-4412-4426-b4b8-421ecf27b14a: CWE-502