Which versions of TYPO3 Crawler are affected by EUVD-2026-30854?

The TYPO3 Crawler extension contains a remote code execution vulnerability (CVE-2026-8727, CVSS 7.1) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-30854?

No vendor-released patch identified at time of analysis. Within 24 hours: Audit all TYPO3 instances to identify those with the Crawler extension enabled and document Scheduler tasks configured to crawl external URLs. Within 7 days: Disable the Crawler extension on instances where it is not actively required; if required, implement compensating controls and restrict configuration access to senior administrators only. Within 30 days: Establish communication with TYPO3 vendor for patch availability timeline; evaluate alternative crawling solutions or TYPO3 upgrade paths; continuously monitor for security updates.

TYPO3 Crawler EUVD-2026-30854

Q: What is the CVSS score of EUVD-2026-30854?

EUVD-2026-30854 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-8727 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-19 TYPO3

GHSA-jr8m-x4p7-p3v5

Deserialization PHP RCE

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

May 19, 2026 - 11:16 EUVD

Analysis Generated

May 19, 2026 - 10:45 vuln.today

CVSS changed

May 19, 2026 - 10:22 NVD

7.1 (HIGH)

DescriptionCVE.org

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

AnalysisAI

Remote code execution in the TYPO3 Crawler extension occurs when the X-T3Crawler-Meta response header from a crawled URL is passed unchecked to PHP's unserialize(), enabling arbitrary PHP object injection. Exploitation requires a high-privileged administrator to configure a crawler-enabled page and a Scheduler task pointing at an attacker-controlled endpoint, so while impact is full RCE on the TYPO3 host, it is gated by an unusual combination of admin access, user interaction, and externally reachable malicious URLs. No public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The TYPO3 Crawler (site_crawler) extension implements a queued URL fetching subsystem used to pre-render or index TYPO3 pages, typically driven by the core Scheduler task framework. As part of its protocol handling it reads an X-T3Crawler-Meta HTTP response header from each crawled URL and feeds its value directly into PHP's unserialize() function - the textbook instance of CWE-502 (Deserialization of Untrusted Data). Because TYPO3 and its extension ecosystem ship many classes with usable __destruct, __wakeup, or __toString magic methods, a crafted serialized payload can chain into a PHP object injection (POP) gadget that executes code under the PHP-FPM/webserver user. The affected CPE is cpe:2.3:a:typo3:extension_site_crawler, which is the third-party Crawler add-on rather than TYPO3 Core.

RemediationAI

Patch available per vendor advisory: upgrade the Crawler extension to the fixed release listed in TYPO3-EXT-SA-2026-008 (https://typo3.org/security/advisory/typo3-ext-sa-2026-008) as soon as it can be staged, since the underlying defect is an unsafe unserialize() call that cannot be safely worked around in configuration. If immediate patching is not possible, restrict the set of accounts holding backend admin privileges and audit existing crawler configurations and Scheduler tasks for entries pointing to externally controlled hostnames; temporarily disabling the Scheduler task that runs the crawler, or disabling/uninstalling the Crawler extension entirely, eliminates the exposure at the cost of losing pre-rendering/indexing automation. Egress filtering that prevents the TYPO3 server from initiating HTTP requests to untrusted external hosts also reduces the attack surface, though it will break any legitimate crawl targets outside the allowlist.