CVE-2026-46725: Remote Code Execution in extension "Content Element Selector" (ceselector)
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46725?
CVE-2026-46725 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-46725?
To fix CVE-2026-46725, promptly update the TYPO3 Content Element Selector extension to the patched version provided by TYPO3.
What is the impact of exploiting CVE-2026-46725?
Exploiting CVE-2026-46725 allows an attacker to execute arbitrary PHP code on the server, leading to potential full system compromise.
Who is affected by CVE-2026-46725?
Any user of the TYPO3 Content Element Selector extension that has not applied security patches is vulnerable to CVE-2026-46725.
Is authentication required to exploit CVE-2026-46725?
No, CVE-2026-46725 can be exploited by remote unauthenticated attackers.