CVE-2026-8727

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

• CWE-502

• https://typo3.org/security/advisory/typo3-ext-sa-2026-008

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8721Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl trunca…9.8
• CVE-2026-8722Net::Async::Statsd::Client versions through 0.005 for Perl a…6.5
• CVE-2026-8723### Summary `qs.stringify` throws `TypeError` when called…6.3
• CVE-2026-8724A security flaw has been discovered in Dataease 2.10.20. Imp…7.2
• CVE-2026-8725A weakness has been identified in CoreWorxLab CAAL up to 1.6…7.3
• CVE-2026-8726The extension fails to properly sanitize user input before u…8.2
• CVE-2026-8728A security vulnerability has been detected in Open5GS up to …6.5
• CVE-2026-8729A vulnerability was detected in Open5GS up to 2.7.7. This af…6.5
• CVE-2026-8730A flaw has been found in Open5GS up to 2.7.6. This impacts t…6.5
• CVE-2026-8731A vulnerability has been found in Open5GS up to 2.7.7. Affec…6.5
• CVE-2026-8732The WP Maps Pro plugin for WordPress is vulnerable to Privil…9.8
• CVE-2026-8733A vulnerability was found in Investintech SlimPDFReader up t…6.3