CVE-2026-46725

The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...

CVE-2026-46725

creationtimestamp| type| source ---|---|--- 2026-05-19 12:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7gtcygzi2t 2026-05-25 16:23:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-46725.yaml 2026-06-01...