CVE-2026-8727
Remote Code Execution in extension "Site Crawler" (crawler)
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Remote Code Execution in extension "Site Crawler" (crawler)
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Record
CVE-2026-8727- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-30854
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Record
EUVD-2026-30854- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jr8m-x4p7-p3v5
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.
- Record
GHSA-jr8m-x4p7-p3v5- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Record
CVE-2026-8727- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Remote Code Execution in extension "Site Crawler" (crawler)
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Record
CVE-2026-8727- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-jr8m-x4p7-p3v5
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.
- Record
GHSA-jr8m-x4p7-p3v5- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tomasnorre/crawlerPackagist |
12.0.0 up to 12.0.11 | 12.0.11 |
tomasnorre/crawlerPackagist |
before 11.0.13 | 11.0.13 |
tomasnorre/crawlerPackagist |
12.0.0 up to 12.0.11, plus listed versions 12.0.112.0.1012.0.212.0.312.0.4 Show 5 moreShow less12.0.512.0.612.0.712.0.812.0.9 |
12.0.11 |
tomasnorre/crawlerPackagist |
before 11.0.13, plus listed versions 10.0.010.0.110.0.210.0.311.0.0 Show 45 moreShow less11.0.111.0.1011.0.1111.0.1211.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.95.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.15.1.25.1.35.1.45.2.05.2.16.0.06.1.06.1.16.1.26.2.06.3.06.3.16.3.26.4.06.4.16.5.06.6.06.6.16.6.26.6.36.6.4 |
11.0.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8727 is a high vulnerability (CVSS 7.1) in Typo3 Extension "site Crawler", published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in tomasnorre/crawler 12.0.11.
References
typo3.org/security/advisory/typo3-ext-sa-2026-008
nvd.nist.gov/vuln/detail/CVE-2026-8727
github.com/FriendsOfPHP/security-advisories/blob/master/tomasnorre/crawler/CVE-2026-8727.yaml
packagist.org
Left out here: 23 versions. The JSON record has them.