Vulnerability · Published May 19, 2026 · Assigned by TYPO3
CVE-2026-46725Remote Code Execution in extension "Content Element Selector" (ceselector)
Critical 9.2
In plain English
A critical-severity unsafe deserialization in Extension "Content Element Selector" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mmc/ceselector | 6.0.1 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | 5.0.1 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | 4.0.2 | GHSA-8x3j-439w-537c |
| Packagist | mmc/ceselector | 3.0.3 | GHSA-8x3j-439w-537c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "Content Element Selector" | 6.0.0 – before 6.0.15.0.0 – before 5.0.14.0.0 – before 4.0.20 – before 3.0.3 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-013 vendor-advisory