GitHub Advisoryadvisory · Packagist

GHSA-jr8m-x4p7-p3v5 TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

HIGH Published 2026-05-19 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-8727
Ecosystem
Packagist
Packages
tomasnorre/crawler
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Weaknesses
CWE-502
Reviewed
2026-06-29

Affected packages

• Packagist tomasnorre/crawler: >= 12.0.0, < 12.0.11 → fixed in 12.0.11 • Packagist tomasnorre/crawler: < 11.0.13 → fixed in 11.0.13

Description

The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's `unserialize()`. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.

Related

Alias · CVE (1)

  • CVE-2026-8727 The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References