Extension "Content Element Selector" - RCE (CVE-2026-46725)
Description
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
psychologyCrowdSec Analysis
CVE-2026-46725 is a critical vulnerability in the TYPO "Content Element Selector" extension that allows remote, unauthenticated attackers to achieve remote code execution by exploiting unsafe handling of attacker-controlled cookies passed to PHP's unserialize() function. By sending a specially crafted serialized payload, threat actors can trigger PHP Object Injection and fully compromise the affected TYPO3 server, provided the extension is configured with "Persistent Mode: Static." This flaw poses a severe risk, enabling attackers to execute arbitrary code and potentially take control of the system
CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-46725 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit insecure deserialization in the TYPO3 ceselector extension by sending malicious serialized PHP objects via cookies named T3_ceselector_* to endpoints such as /, aiming to trigger remote code execution on vulnerable TYPO3 installations.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-05-19 |
| Rule Released | 2026-05-27 |