Deserialization in TYPO3 Extension "Content Element Selector"

CVE-2026-46725

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Vulnerability class: Insecure Deserialization

Published · last modified .

EPSS exploit prediction

EPSS: 0.019 (78.4th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-46725: fell from 0.026 to 0.019.

EPSS over last 30 days · oldest: 0.026 · newest: 0.019 · change: -0.008

Affected products

Weakness classification (CWE)

References