CVE-2026-46725 Details
Description
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
A remote code execution vulnerability has been identified in the TYPO3 extension 'Content Element Selector' (ceselector), specifically in versions 6.0.0, 5.0.0, 4.0.0 - 4.0.1, and 3.0.2 and below. The issue arises from the extension's failure to properly sanitize an attacker-controlled cookie before passing it to PHP's unserialize() function. This vulnerability allows for PHP Object Injection, which can be exploited to execute arbitrary code on the TYPO3 server. Successful exploitation requires the content element to be set to 'Persistent Mode: Static' in the plugin settings.
Users are advised to update the 'Content Element Selector' extension to version 6.0.1, 5.0.1, 4.0.2, or 3.0.3. These versions are available through the TYPO3 Extension Manager, Packagist, and the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-013 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Content Element Selector | >= 3.0.3, < 3.0.3 (semver) 4.0.0 - 4.0.1 5.0.0 (semver) 6.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | TYPO3 |