GHSA-jr8m-x4p7-p3v5

Suggest an improvement
Source
https://github.com/advisories/GHSA-jr8m-x4p7-p3v5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jr8m-x4p7-p3v5/GHSA-jr8m-x4p7-p3v5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jr8m-x4p7-p3v5
Aliases
Published
2026-05-19T12:31:39Z
Modified
2026-09-10T03:51:06Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator
Summary
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
Details

The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.

Database specific 
{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-29T17:39:15Z",
    "nvd_published_at":  "2026-05-19T10:16:25Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / tomasnorre/crawler

Package

Name
tomasnorre/crawler
Purl
pkg:composer/tomasnorre/crawler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.0.0
Fixed
12.0.11

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jr8m-x4p7-p3v5/GHSA-jr8m-x4p7-p3v5.json"

Packagist / tomasnorre/crawler

Package

Name
tomasnorre/crawler
Purl
pkg:composer/tomasnorre/crawler

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.0.13

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
6.*
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.5.0
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.7.0
6.7.1
6.7.2
6.7.3
6.7.4
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.1.0
9.1.1
9.1.2
9.1.3
9.1.4
9.1.5
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
10.*
10.0.0
10.0.1
10.0.2
10.0.3
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
11.0.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jr8m-x4p7-p3v5/GHSA-jr8m-x4p7-p3v5.json"