Is there a patch available for CVE-2026-49740?

Yes, a patch is available for CVE-2026-49740. Update the affected software to the latest version immediately.

TYPO3 CMS CVE-2026-49740

Q: What is the CVSS score of CVE-2026-49740?

CVE-2026-49740 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-35401 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-06-09 f4fb688c-4412-4426-b4b8-421ecf27b14a

GHSA-c78m-c52x-jgwp

PHP Deserialization RCE

6.3

CVSS 4.0 · Vendor: f4fb688c-4412-4426-b4b8-421ecf27b14a

Severity by source

Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) · only source for this CVE.

CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 09, 2026 - 13:01 EUVD

Source Code Evidence Fetched

Jun 09, 2026 - 11:41 vuln.today

Analysis Generated

Jun 09, 2026 - 11:41 vuln.today

DescriptionCVE.org

TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.

AnalysisAI

PHP Object Injection in TYPO3 CMS's cache frontend (VariableFrontend) and persistent key-value store (Registry) exposes TYPO3 installations to potential Remote Code Execution when an attacker controls write access to the underlying storage layer. The root cause is bare PHP unserialize() calls on storage-retrieved data without HMAC integrity validation or class allowlists, meaning attacker-controlled data in the sys_registry table or cache backend can trigger deserialization of crafted PHP objects through a gadget chain. No public exploit has been identified at time of analysis and no CISA KEV listing exists; however, the CVSS 4.0 Subsequent impact scores (SC:H/SI:H/SA:H) confirm that successful exploitation yields full system-level impact despite the local access prerequisite.

Technical ContextAI

The vulnerability resides in two TYPO3 core classes: typo3/sysext/core/Classes/Cache/Frontend/VariableFrontend.php, which serializes and deserializes cached PHP values to and from persistent storage backends, and typo3/sysext/core/Classes/Registry.php, which stores and retrieves key-value pairs from the sys_registry database table. Both previously used PHP's native unserialize() function directly on untrusted storage data with no integrity check - a textbook CWE-502 (Deserialization of Untrusted Data) flaw. The fix, visible in commit 48bcf24f, introduces an AuthenticatedMessageDeserializer that wraps serialized payloads in an HMAC-SHA3-384 signature using TYPO3's HashService, so tampered or injected cache entries are rejected before deserialization. The Registry class receives a DenyListDeserializer with class restrictions. A third site, ProcessedFile, gains an allowed_classes => [Area::class] restriction. The attack depends on the availability of a usable PHP Object Injection gadget chain within the loaded class context - a common condition in complex CMS ecosystems with numerous dependencies.

RemediationAI

Upgrade TYPO3 CMS to a patched release: 10.4.57 for the 10.4.x branch, 11.5.52 for the 11.x branch, 12.4.47 for the 12.x branch, 13.4.32 for the 13.x branch, or 14.3.4 for the 14.x branch - these versions are inferred from the affected range boundaries and should be confirmed against the vendor advisory at https://typo3.org/security/advisory/typo3-core-sa-2026-018 before deployment. The upstream fix commits are available at https://github.com/TYPO3/typo3/commit/48bcf24f31f52cc0b43d3bea4984634bd2cf85c7 and https://github.com/TYPO3/typo3/commit/87cd7c5b710c44d3606fed277b040a75dc6a9c02. Where immediate patching is not possible, restrict database-level WRITE permissions on the sys_registry table to only the TYPO3 application service account, and audit who holds direct database write access - this does not eliminate the vulnerability but removes the prerequisite write access needed for exploitation. Similarly, restrict file system write access to cache directories to the web server process only. Be aware that overly restricting the application account may break TYPO3 extension functionality that depends on Registry writes.