CVE-2026-49740

CVE-2026-49740

TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store…

Vulnerability class: Insecure Deserialization

Weakness classification (CWE)

References