PHP Object Injection Vulnerability in TYPO3 Extension

CVE-2026-77138

What is CVE-2026-77138?

An issue has been identified in a TYPO3 extension where untrusted client input, specifically a crafted attacker-controlled cookie, is improperly handled. When this untrusted input is processed through PHP's unserialize() function, it allows for PHP Object Injection. This vulnerability can be exploited by a remote, unauthenticated attacker, enabling them to inject malicious serialized payloads that lead to Remote Code Execution on the TYPO3 server. Organizations using the affected extension are urged to update to mitigate this security risk.

References