PHP Object Injection Vulnerability in TYPO3 CMS by TYPO3
CVE-2026-49740

6.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 June 2026

What is CVE-2026-49740?

The vulnerability in TYPO3 allows for PHP Object Injection through its cache frontend and persistent key-value store. Specifically, the VariableFrontend and Registry components lack integrity checks, enabling an attacker with write access to exploit this issue by injecting crafted serialized payloads. This could result in Remote Code Execution if a gadget chain is triggered. Direct local write access to either the SQL database or file system is necessary for the attack, making the exploitation of this vulnerability especially concerning for users of TYPO3 CMS across several affected versions.

Affected Version(s)

TYPO3 CMS 0 < 10.4.57

TYPO3 CMS 11.0.0 < 11.5.51

TYPO3 CMS 12.0.0 < 12.4.46

References

https://typo3.org/security/advisory/typo3-core-sa-2026-018
vendor-advisory
https://github.com/TYPO3/typo3/commit/48bcf24f31f52cc0b43...
patch
https://github.com/TYPO3/typo3/commit/87cd7c5b710c44d3606...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

z3rco
Chowdhury Faizal Ahammed
Rick Larabee
Vitaly Simonovich
Nozomu Sasaki
Mert Akdag
tikket
Shafi Almutairi
Oliver Hader
.