CVE-2026-8727
- Source
- https://cve.org/CVERecord?id=CVE-2026-8727
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8727.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-8727
- Aliases
- Published
- 2026-05-19T09:16:33.677Z
- Modified
- 2026-07-15T01:48:52.132554811Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator
- Summary
- Remote Code Execution in extension "Site Crawler" (crawler)
- Details
-
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8727.json", "cwe_ids": [ "CWE-502" ], "cna_assigner": "TYPO3" }- References
Affected packages
Git / github.com/tomasnorre/crawler
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tomasnorre/crawler
- Events
-
IntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "12.0.0" }, { "fixed": "12.0.11" }, { "introduced": "0" }, { "fixed": "11.0.13" } ] }
Affected versions
10.*
10.0.0
10.0.1
10.0.2
10.0.3
11.*
11.0.0
11.0.1
11.0.10
11.0.11
11.0.12
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
12.*
12.0.0
12.0.1
12.0.10
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
3.*
3.5.1
3.6.0
3.6.1
3.6.2
4.*
4.0.0
4.1.0
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
6.*
6.0.0
6.1.0
6.1.1
6.1.2
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.1.0
9.1.1
9.1.2
9.1.3
9.1.4
9.1.5
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5