by Kastro
Paper/Archive/CVE-2026-46725

CVE-2026-46725

TYPO3 Extension "Content Element Selector" — Remote Code Execution in extension "Content Element Selector" (ceselector)

EPSS 3%CVSS 9.2
critical.is priorityof 100
45
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 85.5.855 × 2017.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Affected

ProductAffectedFixed inSource
Extension "Content Element Selector"6.0.0 – < 6.0.16.0.1CNA
Extension "Content Element Selector"5.0.0 – < 5.0.15.0.1CNA
Extension "Content Element Selector"4.0.0 – < 4.0.24.0.2CNA
Extension "Content Element Selector"< 3.0.33.0.3CNA

Scores by source

TYPO3 (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorytypo3.org/security/advisory/typo3-ext-sa-2026-013