CVE-2026-46725
Published: 19 May 2026
Summary
CVE-2026-46725 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Typo3 (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2026-46725 is a PHP Object Injection flaw in a TYPO3 extension that passes an attacker-controlled cookie directly into PHP's unserialize() function without safe input handling. This deserialization issue, tracked as CWE-502, occurs only when the affected content element is configured with "Persistent Mode: Static" and can lead to remote code execution on the TYPO3 server. It received a CVSS 4.0 score of 9.2.
A remote unauthenticated attacker can supply a crafted serialized payload through the cookie to trigger object injection and obtain remote code execution. The attack requires no user interaction or authentication but depends on the plugin setting noted above.
The official TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-013 addresses mitigation for the affected extension. The EPSS score has remained flat at 0.0327 with no material rise from its initial value.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30865
Vulnerability details
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation…
more
requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated RCE via unsafe deserialization in a public-facing TYPO3 web application/extension matches T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.