GHSA-96jg-pmc4-cx39
TYPO3 CMS Insecure Deserialization
It has been discovered that the Form Framework (system extension form) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package yaml, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting yaml.decode_php enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
TYPO3 CMS Insecure Deserialization
It has been discovered that the Form Framework (system extension form) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package yaml, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting yaml.decode_php enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).
- Record
GHSA-96jg-pmc4-cx39- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
TYPO3 CMS Insecure Deserialization
It has been discovered that the Form Framework (system extension form) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package yaml, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting yaml.decode_php enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).
- Record
GHSA-96jg-pmc4-cx39- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
8.5.0 up to 8.7.17 | 8.7.17 |
typo3/cms-corePackagist |
9.0.0 up to 9.3.1 | 9.3.1 |
typo3/cms-corePackagist |
8.5.0 up to 8.7.17, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 5 moreShow lessv8.7.15v8.7.16v8.7.7v8.7.8v8.7.9 |
8.7.17 |
typo3/cms-corePackagist |
9.0.0 up to 9.3.1, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 |
9.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-96jg-pmc4-cx39 is a high vulnerability (CVSS 7.5) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.17.