Apache Solr for TYPO3 EUVD-2026-65350

Exploitation requires three concurrent conditions to be satisfied simultaneously: (1) the attacker holds a TYPO3 account - backend editor or frontend user - with sufficient privileges to create or modify content records (authenticated, PR:L); (2) the target TYPO3 site has Solr indexing configured with at least one field using the SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types in TypoScript, a deliberate non-default configuration; and (3) the attacker's user-generated content can flow through the database into one of those indexed fields without being stripped, sanitized, or access-gated before the indexer processes it. A fourth practical constraint limits exploitability: a viable PHP gadget chain must exist among the classes loaded in the target application's PHP runtime - sites with lean Composer dependency trees may be harder to exploit even if object injection is achieved. Sites that restrict TYPO3 content-editing exclusively to trusted administrators, or that do not use the three vulnerable content object types in their Solr index configuration, are not realistically at risk regardless of patch status.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) correctly captures a high-impact but precondition-gated vulnerability. Attack Complexity is High and Attack Requirements are Present, reflecting that exploitation demands both a specific TypoScript configuration (the vulnerable content object types must be configured and mapped to user-reachable fields) and an authenticated low-privilege account capable of submitting content to those fields. The impact metrics (VC:H/VI:H/VA:H) are appropriate for PHP Object Injection, which can yield full server compromise via gadget chains. Real-world risk is further bounded by the need for a viable gadget chain in the application's Composer dependency graph - environments with minimal dependencies may have fewer exploitable chains even if object injection is achieved. No EPSS data, KEV listing, or public POC was provided in the available intelligence; exploitation status is assessed as no public exploit identified at time of analysis. Priority remediation is warranted for TYPO3 deployments with Solr indexing enabled and user-generated content flows, particularly those exposing content-editing to semi-trusted or untrusted users.

An authenticated TYPO3 user with content-editing rights submits a record containing a crafted, serialized PHP object payload into a field that maps to a SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION Solr index field configured in TypoScript. When the Solr indexer processes this record, the extension passes the attacker-controlled field value to PHP's unserialize(), instantiating the injected object and triggering magic methods that invoke a gadget chain present in the application's loaded PHP classes, ultimately executing arbitrary code with the web server process's operating system permissions. No public exploit code has been identified at time of analysis, but PHP Object Injection is a well-documented attack class and gadget chains for common TYPO3 and Composer-managed PHP environments are broadly researched and publicly catalogued.