EUVD-2026-65350
GHSA-r2vh-j53r-xpr5
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via authenticated editor account (PR:L, AV:N); high complexity due to required TypoScript configuration and gadget chain dependency; no scope change indicated.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
Lifecycle Timeline
3DescriptionCVE.org
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.
AnalysisAI
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions to be satisfied simultaneously: (1) the attacker holds a TYPO3 account - backend editor or frontend user - with sufficient privileges to create or modify content records (authenticated, PR:L); (2) the target TYPO3 site has Solr indexing configured with at least one field using the SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types in TypoScript, a deliberate non-default configuration; and (3) the attacker's user-generated content can flow through the database into one of those indexed fields without being stripped, sanitized, or access-gated before the indexer processes it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) correctly captures a high-impact but precondition-gated vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched version of the Apache Solr for TYPO3 extension as specified in the vendor security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-025; the exact fix version is not independently confirmed from available data and must be verified directly from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all TYPO3 instances using the Apache Solr extension, then restrict indexing functionality access to essential administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today