Vulnerability · Published May 19, 2026 · Assigned by TYPO3

CVE-2026-8727Remote Code Execution in extension "Site Crawler" (crawler)

High 7.1

In plain English

A high-severity unsafe deserialization in Extension "Site Crawler" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 66.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	tomasnorre/crawler	12.0.11	GHSA-jr8m-x4p7-p3v5
Packagist	tomasnorre/crawler	11.0.13	GHSA-jr8m-x4p7-p3v5

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Site Crawler"	12.0.0 – before 12.0.110 – before 11.0.13

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-008 vendor-advisory