# CVE-2026-46725: Extension "Content Element Selector" - RCE

> Live exploitation tracking for CVE-2026-46725 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-46725

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.2
- **Public exploit available:** Yes
- **Affected products:** TYPO3 Extension "Content Element Selector"
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** cms, php

## Description

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

## CrowdSec analysis

[CVE-2026-46725](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-46725) is a critical vulnerability in the TYPO  "Content Element Selector" extension that allows remote, unauthenticated attackers to achieve remote code execution by exploiting unsafe handling of attacker-controlled cookies passed to PHP's unserialize() function. By sending a specially crafted serialized payload, threat actors can trigger PHP Object Injection and fully compromise the affected TYPO3 server, provided the extension is configured with "Persistent Mode: Static." This flaw poses a severe risk, enabling attackers to execute arbitrary code and potentially take control of the system

CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-46725 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit insecure deserialization in the TYPO3 ceselector extension by sending malicious serialized PHP objects via cookies named `T3_ceselector_*` to endpoints such as `/`, aiming to trigger remote code execution on vulnerable TYPO3          installations.

## Timeline

- 2026-05-19: CVE Published. CVE-2026-46725 is published to NVD.
- 2026-05-27: Rule Released. CrowdSec releases a rule to detect CVE-2026-46725 exploitation attempts against the CrowdSec Network.

## References

- https://typo3.org/security/advisory/typo3-ext-sa-2026-013
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-46725.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-46725) follows observed exploitation activity for CVE-2026-46725. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.