GHSA-8x3j-439w-537c TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)

• Packagist mmc/ceselector: >= 6.0.0, < 6.0.1 → fixed in 6.0.1 • Packagist mmc/ceselector: >= 5.0.0, < 5.0.1 → fixed in 5.0.1 • Packagist mmc/ceselector: >= 4.0.0, < 4.0.2 → fixed in 4.0.2 • Packagist mmc/ceselector: < 3.0.3 → fixed in 3.0.3

The TYPO3 "Content Element Selector" (ceselector) extension passes an attacker-controlled cookie directly to PHP's `unserialize()` without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with `Persistent Mode: Static` in the plugin settings. This has been patched in version 3.0.3, 4.0.2, 5.0.1, and 6.0.1.