What is the CVSS score of CVE-2026-46725?

CVE-2026-46725 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-46725?

Yes, a public proof-of-concept exploit is available for CVE-2026-46725. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-46725?

Within 24 hours: Enumerate all TYPO3 instances with 'Content Element Selector' extension active, identify those configured with 'Persistent Mode: Static', and disable the extension if business impact permits; engage WAF team to begin rule development. Within 7 days: Deploy WAF rules blocking HTTP cookies containing PHP serialization signatures; parse web logs for exploitation attempts (look for suspicious cookie patterns); implement intrusion detection signatures for unserialize() attacks. Within 30 days: Monitor vendor advisory for patch release; upon patch availability, test in staging (TYPO3 version must match exactly) and deploy to production; conduct forensic review of logs from past 90 days for evidence of exploitation.

TYPO3 Content Element Selector CVE-2026-46725

Q: Which versions of TYPO3 Content Element Selector are affected by CVE-2026-46725?

TYPO3 installations running the 'Content Element Selector' extension (CVE-2026-46725, CVSS 9.2) face critical unauthenticated remote code execution risk via a PHP deserialization flaw, with no vendor…. A patch is available.

EUVD-2026-30865 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-19 TYPO3

GHSA-8x3j-439w-537c

PHP RCE Deserialization Typo3 Extension Content Element Selector

9.2

CVSS 4.0 · Vendor: TYPO3

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify TYPO3 site with vulnerable extension
Delivery

Locate page using Persistent Mode: Static
Exploit

Craft serialized PHP gadget chain
Execution

Send HTTP request with malicious cookie
Persist

Extension calls unserialize() on cookie
Impact

Gadget chain executes PHP code on server

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that at least one content element on the target TYPO3 site be configured with 'Persistent Mode: Static' in the Content Element Selector plugin settings - this is the AT:P (Attack Requirements: Present) condition captured in the CVSS vector. Beyond that, no authentication (PR:N), no user interaction (UI:N), and only network reachability to the affected page are needed; the attacker delivers the payload as a crafted value in the cookie the extension reads. Sites that have the extension installed but do not use Persistent Mode: Static on any element are not exploitable via this path.
Impact	The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H indicates network reach, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with a serious unauthenticated RCE. The AT:P (Attack Requirements: Present) flag is important: the vendor confirms exploitation only works when the content element is configured with 'Persistent Mode: Static', which is what tempers the score from a perfect 10 to 9.2 and means non-default deployments are not exploitable. EPSS and CISA KEV status were not provided in the input, and no public exploit identified at time of analysis; however, PHP Object Injection chains in TYPO3 ecosystems have historically been weaponized quickly once disclosed. Net: treat as a high-priority patch where the extension is installed, but inventory configurations first because the AT:P condition meaningfully reduces the exposed population.
Exploit ScenarioDerived	An attacker enumerates TYPO3 sites running the Content Element Selector extension and probes pages where a content element uses Persistent Mode: Static. The attacker constructs a PHP serialized payload chaining gadgets from loaded TYPO3 classes, sends a single HTTP request with the malicious value placed in the targeted cookie, and unserialize() instantiates the gadget chain, yielding remote code execution under the web server account with no authentication or user interaction required.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 19, 2026

Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbitrary PHP code by sending a crafted cookie that the extension feeds directly into PHP's unserialize(). The flaw (CWE-502, CVSS 4.0 score 9.2) is exploitable only on installations where a content element is configured with 'Persistent Mode: Static'. No public exploit identified at time of analysis, though the deserialization pattern is well-understood and typically rapid to weaponize.

RemediationAI

Patch available per vendor advisory - upgrade the Content Element Selector extension to the fixed release identified in TYPO3-EXT-SA-2026-013 at https://typo3.org/security/advisory/typo3-ext-sa-2026-013 (exact fix version not provided in the supplied data, so consult the advisory). As an interim compensating control, reconfigure any affected content elements away from 'Persistent Mode: Static' to a non-vulnerable persistence mode, which removes the trigger condition described in the advisory at the cost of changing the element's caching/state behavior. If reconfiguration is not feasible, restrict access to the affected pages with WAF rules that strip or reject the relevant cookie on requests to those URLs, accepting that this may break legitimate functionality and is fragile against cookie-name variations.

Affected VersionsENISA

Extension "Content Element Selector" 6.0.0 <6.0.1

Extension "Content Element Selector" 5.0.0 <5.0.1

Extension "Content Element Selector" 4.0.0 <4.0.2

Extension "Content Element Selector" 0 <3.0.3

Affected Packages

composer mmc/ceselector fix: 3.0.3, 4.0.2, 5.0.1, 6.0.1

euvd extension_content_element_selector fix: 3.0.3, 4.0.2, 5.0.1, 6.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in composer, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

TYPO3 is a PHP-based enterprise CMS, and the 'Content Element Selector' is a third-party extension (CPE cpe:2.3:a:typo3:extension_"content_element_selector") used to manage selectable content elements within pages. The root cause is CWE-502 (Deserialization of Untrusted Data): the extension reads an attacker-controlled cookie value and passes it directly into PHP's unserialize() function. In PHP, unserialize() instantiates objects and invokes magic methods such as __wakeup() and __destruct(); when combined with classes present in TYPO3 core or other loaded extensions, this creates a POP (Property-Oriented Programming) gadget chain that can be steered toward arbitrary code execution. This is the same class of bug behind numerous historical PHP RCEs and is structurally hard to mitigate without removing the unserialize() call or migrating to a safe format such as JSON.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (TYPO3) PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TYPO3) · only source for this CVE.

CVSS VectorVendor: TYPO3

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

May 19, 2026 - 11:16 EUVD

CVSS changed

May 19, 2026 - 10:22 NVD

9.2 (CRITICAL)

DescriptionCVE.org

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Executive ViewAI

Why It Matters

TYPO3 installations running the 'Content Element Selector' extension (CVE-2026-46725, CVSS 9.2) face critical unauthenticated remote code execution risk via a PHP deserialization flaw, with no vendor patch currently available. Attackers need only send a crafted cookie to compromise affected servers completely, exposing organizations to data theft, service disruption, and potential lateral movement into critical systems. Organizations must inventory vulnerable deployments and deploy compensating controls immediately, as the exploitation technique is well-understood and likely to be weaponized rapidly.

Business Impact: Severe

Compensating Controls

Disable 'Content Element Selector' extension immediately; deploy WAF rules blocking serialized PHP object patterns in HTTP cookie headers; restrict network access to TYPO3 instances to internal IP ranges and known administrative networks only; configure application-level PHP deserialization attack detection; enable enhanced logging on all cookie processing and unserialize() function calls.

Threat Intelligence Overview

EPSS Score

0.4%

Top 42% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.