CVE-2026-46725: TYPO3 Extension PHP Object Injection via Cookie Deserialization

Overview

CVE-2026-46725 affects a TYPO3 extension that passes an attacker-controlled cookie directly to PHP's unserialize() function. The weakness is classified as CWE-502, Deserialization of Untrusted Data. The vendor advisory referenced in the record is TYPO3-EXT-SA-2026-013.

Impact

According to the record, a remote, unauthenticated attacker can supply a crafted serialized value that triggers PHP Object Injection, which can lead to Remote Code Execution on the TYPO3 server. The CNA-provided CVSS 4.0 vector indicates network attack vector, low attack complexity, attack requirements present, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable system. The CNA base score is 9.2 (critical).

Affected products and versions

• The record does not list affected products or versions, and it does not name the extension.
• The record does not list fixed versions. The absence of a fixed version in the record does not mean no fix exists; consult the vendor advisory.
• Exploitation is described as requiring the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.01859 with a percentile of 0.78681, which estimates likelihood of exploitation activity and is not a confirmation of attacks.

Remediation and mitigation

• Identify whether any TYPO3 installation uses the affected extension, and check the extension version against the vendor advisory.
• Review content element configurations and check whether "Persistent Mode: Static" is in use; reducing or removing this configuration where operationally possible limits exposure according to the record's stated condition.
• Apply the vendor-provided update or follow the mitigation guidance in the advisory TYPO3-EXT-SA-2026-013.
• Restrict exposure of administrative and unnecessary public endpoints while remediation is pending.

Detection guidance

• Inventory TYPO3 extensions and flag any installation of the affected extension for review.
• Review web server and application logs for requests to pages using the affected content element that carry unusually large or malformed cookie values.
• Monitor application servers for unexpected child processes or outbound connections originating from the PHP runtime, as signs of post-exploitation activity.

Limitations of the available information

• The record does not identify the extension name, affected versions or fixed versions.
• The source status is marked as Deferred in the record.
• The CVSS score comes from the CNA only; no other provider score is present.
• The EPSS data in the record is provided as-is and does not confirm exploitation.

Frequently asked questions

What is CVE-2026-46725?

It is a critical deserialization vulnerability (CWE-502) in a TYPO3 extension that passes an attacker-controlled cookie to PHP's unserialize() function. The record links it to PHP Object Injection and possible Remote Code Execution.

Does this CVE require authentication?

According to the record, the attacker is remote and unauthenticated. The CVSS 4.0 vector from the CNA lists privileges required as none and user interaction as none.

Is this vulnerability known to be exploited?

The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Which versions are affected?

The record does not list affected or fixed versions, so this information is unknown. Check the vendor advisory at typo3.org for details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.