CVE-2026-8727

High

Description

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

SeverityHigh

CVSS7.1

Exploit probability—

ProductTomasnorre/crawler

PublishedMay 19, 2026

First seenMay 19, 2026

Weakness typeCWE-502Deserialization of untrusted data

How to fix

Update

tomasnorre/crawler12.0.11, 11.0.13 or later

Vendor advisories

typo3.org/security/advisory/typo3-ext-sa-2026-008

Affected products

Product	Affected versions	Fixed in
tomasnorre/crawlerPackagist	12.0.0 ≤ v < 12.0.11, v < 11.0.13	12.0.11, 11.0.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.