GHSA-m2hp-5x78-74mg
Insecure Unserialize Vulnerability in FLOW3
Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3.
To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.
What each source reports
GitHub AdvisoriesNo score
Insecure Unserialize Vulnerability in FLOW3
Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3.
To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.
- Record
GHSA-m2hp-5x78-74mg- Updated
- 2026-11-02
OSVNo score
Insecure Unserialize Vulnerability in FLOW3
Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3.
To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.
- Record
GHSA-m2hp-5x78-74mg- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/flowPackagist | 1.0.0 up to 1.0.4 | 1.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-m2hp-5x78-74mg is a vulnerability with no CVSS score yet in typo3/flow, published June 5, 2024. No source lists public exploit code. Fixed in typo3/flow 1.0.4.