Which versions of TYPO3 Content Element Selector are affected by CVE-2026-46725?

TYPO3 installations running the 'Content Element Selector' extension (CVE-2026-46725, CVSS 9.2) face critical unauthenticated remote code execution risk via a PHP deserialization flaw, with no vendor…. A patch is available.

Is there a public PoC exploit available for CVE-2026-46725?

Yes, a public proof-of-concept exploit is available for CVE-2026-46725. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-46725?

Within 24 hours: Enumerate all TYPO3 instances with 'Content Element Selector' extension active, identify those configured with 'Persistent Mode: Static', and disable the extension if business impact permits; engage WAF team to begin rule development. Within 7 days: Deploy WAF rules blocking HTTP cookies containing PHP serialization signatures; parse web logs for exploitation attempts (look for suspicious cookie patterns); implement intrusion detection signatures for unserialize() attacks. Within 30 days: Monitor vendor advisory for patch release; upon patch availability, test in staging (TYPO3 version must match exactly) and deploy to production; conduct forensic review of logs from past 90 days for evidence of exploitation.

TYPO3 Content Element Selector CVE-2026-46725

Q: What is the CVSS score of CVE-2026-46725?

CVE-2026-46725 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-30865 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-19 TYPO3

GHSA-8x3j-439w-537c

Deserialization PHP RCE

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 19, 2026 - 11:16 EUVD

Analysis Generated

May 19, 2026 - 10:45 vuln.today

CVSS changed

May 19, 2026 - 10:22 NVD

9.2 (CRITICAL)

DescriptionCVE.org

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

AnalysisAI

Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbitrary PHP code by sending a crafted cookie that the extension feeds directly into PHP's unserialize(). The flaw (CWE-502, CVSS 4.0 score 9.2) is exploitable only on installations where a content element is configured with 'Persistent Mode: Static'. No public exploit identified at time of analysis, though the deserialization pattern is well-understood and typically rapid to weaponize.

Technical ContextAI

TYPO3 is a PHP-based enterprise CMS, and the 'Content Element Selector' is a third-party extension (CPE cpe:2.3:a:typo3:extension_"content_element_selector") used to manage selectable content elements within pages. The root cause is CWE-502 (Deserialization of Untrusted Data): the extension reads an attacker-controlled cookie value and passes it directly into PHP's unserialize() function. In PHP, unserialize() instantiates objects and invokes magic methods such as __wakeup() and __destruct(); when combined with classes present in TYPO3 core or other loaded extensions, this creates a POP (Property-Oriented Programming) gadget chain that can be steered toward arbitrary code execution. This is the same class of bug behind numerous historical PHP RCEs and is structurally hard to mitigate without removing the unserialize() call or migrating to a safe format such as JSON.

RemediationAI

Patch available per vendor advisory - upgrade the Content Element Selector extension to the fixed release identified in TYPO3-EXT-SA-2026-013 at https://typo3.org/security/advisory/typo3-ext-sa-2026-013 (exact fix version not provided in the supplied data, so consult the advisory). As an interim compensating control, reconfigure any affected content elements away from 'Persistent Mode: Static' to a non-vulnerable persistence mode, which removes the trigger condition described in the advisory at the cost of changing the element's caching/state behavior. If reconfiguration is not feasible, restrict access to the affected pages with WAF rules that strip or reject the relevant cookie on requests to those URLs, accepting that this may break legitimate functionality and is fragile against cookie-name variations.