CVE-2026-49740
Description
TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
How to fix
- typo3/cms-core10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3/cms-corePackagist | v < 10.4.57, 11.0.0 ≤ v < 11.5.51, 12.0.0 ≤ v < 12.4.46, 13.0.0 ≤ v < 13.4.31, 14.0.0 ≤ v < 14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.