{"id":"CVE-2026-8727","aliases":["EUVD-2026-30854","GHSA-jr8m-x4p7-p3v5"],"status":"published","title":"Remote Code Execution in extension \"Site Crawler\" (crawler)","description":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0039,"percentile":0.33545,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-05-19T09:16:33Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"Packagist","package":"tomasnorre/crawler","fixed_in":["12.0.11","11.0.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"tomasnorre/crawler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"tomasnorre/crawler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.13"}]}]},{"source":"osv","ecosystem":"Packagist","package":"tomasnorre/crawler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.11"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"tomasnorre/crawler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.13"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.2.0","5.2.1","6.0.0","6.1.0","6.1.1","6.1.2","6.2.0","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.5.0","6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","9.0.0","9.0.1","9.0.2","9.0.3","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6"]}],"products":[{"vendor":"typo3","product":"extension \"site crawler\""}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-008","tags":["vendor-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8727","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/tomasnorre/crawler/CVE-2026-8727.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jr8m-x4p7-p3v5"},{"url":"https://packagist.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8727.json","tags":["advisory"]},{"url":"https://github.com/tomasnorre/crawler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-8727","title":"Remote Code Execution in extension \"Site Crawler\" (crawler)","description":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","status":"published","published":"2026-05-19T09:16:33.677Z","modified":"2026-05-19T13:25:34.994Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-30854","description":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","status":"published","published":"2026-05-19T09:16:33Z","modified":"2026-05-19T13:25:34Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T18:21:15.688012Z"}],"ghsa":[{"id":"GHSA-jr8m-x4p7-p3v5","title":"TYPO3 Remote Code Execution in extension \"Site Crawler\" (crawler)","description":"The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's `unserialize()`. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.","status":"published","published":"2026-05-19T12:31:39Z","modified":"2026-06-29T17:39:16Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:40:34.713036Z"}],"nvd":[{"id":"CVE-2026-8727","description":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","status":"published","published":"2026-05-19T10:16:25.747Z","modified":"2026-10-26T13:10:00.14Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-8727","title":"Remote Code Execution in extension \"Site Crawler\" (crawler)","description":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","status":"published","published":"2026-05-19T09:16:33.677Z","modified":"2026-10-28T02:30:34.571440477Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"GHSA-jr8m-x4p7-p3v5","title":"TYPO3 Remote Code Execution in extension \"Site Crawler\" (crawler)","description":"The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's `unserialize()`. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.","status":"published","published":"2026-05-19T12:31:39Z","modified":"2026-09-10T03:51:06.299859616Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}