Description
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Content Element Selector" | 6.0.0 – < 6.0.1, 5.0.0 – < 5.0.1, 4.0.0 – < 4.0.2, < 3.0.3 | 6.0.1 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- TYPO3 ceselector Extension - Insecure Deserialization http/cves/2026/CVE-2026-46725.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mmc/ceselector | >= 6.0.0, < 6.0.1 | 6.0.1 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | >= 5.0.0, < 5.0.1 | 5.0.1 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | >= 4.0.0, < 4.0.2 | 4.0.2 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | < 3.0.3 | 3.0.3 | GHSA-8x3j-439w-537c |
Advisories 1
- WID-SEC-2026-1585 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 19, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-013 vendor-advisory