Deserialization in Typo3 Cms

CVE-2026-49740

TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store…

Vulnerability class: Insecure Deserialization

EPSS: 0.002 (12.1th percentile) — read the EPSS interpretation.