tomasnorre/crawler · Security
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
- GHSA ID
- GHSA-jr8m-x4p7-p3v5
- CVE ID
- CVE-2026-8727
- Severity
- high
- Published
- Updated
- CVSS v4
- 7.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Description
The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.
CWEs
- CWE-502 · Deserialization of Untrusted Data