Read the docs
TI-2026-34350 Aliases CVE-2026-46725GHSA-8x3j-439w-537c

Remote Code Execution in extension "Content Element Selector" (ceselector)

Priority MEDIUM 47CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02625 85th percentileScored 2026-11-07
Fix Fixed Extension "Content Element Selector" (TYPO3): 6.0.1, 5.0.1, 4.0.2 +1mmc/ceselector (Packagist): 6.0.1, 5.0.1, 4.0.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "Content Element Selector"6.0.0 to before 6.0.1; 5.0.0 to before 5.0.1; 4.0.0 to before 4.0.2; before 3.0.36.0.1, 5.0.1, 4.0.2, 3.0.3Patch availableCNA
—mmc/ceselector (Packagist)6.0.0 to before 6.0.16.0.1Patch availableGHSA-8x3j-439w-537c
—mmc/ceselector (Packagist)5.0.0 to before 5.0.15.0.1Patch availableGHSA-8x3j-439w-537c
—mmc/ceselector (Packagist)4.0.0 to before 4.0.24.0.2Patch availableGHSA-8x3j-439w-537c
—mmc/ceselector (Packagist)before 3.0.33.0.3Patch availableGHSA-8x3j-439w-537c
  • Extension "Content Element Selector" VendorTYPO3 Affected 6.0.0 to before 6.0.1; 5.0.0 to before 5.0.1; 4.0.0 to before 4.0.2; before 3.0.3 Fixed in 6.0.1, 5.0.1, 4.0.2, 3.0.3 Patch available CNA
  • mmc/ceselector (Packagist) Vendor— Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-8x3j-439w-537c
  • mmc/ceselector (Packagist) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-8x3j-439w-537c
  • mmc/ceselector (Packagist) Vendor— Affected 4.0.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-8x3j-439w-537c
  • mmc/ceselector (Packagist) Vendor— Affected before 3.0.3 Fixed in 3.0.3 Patch available GHSA-8x3j-439w-537c

Remediation

  • Fix · CNA Extension "Content Element Selector" (TYPO3) Fixed in 6.0.1, 5.0.1, 4.0.2, 3.0.3
  • Fix · GHSA-8x3j-439w-537c mmc/ceselector (Packagist) Fixed in 6.0.1 Advisory →
  • Fix · GHSA-8x3j-439w-537c mmc/ceselector (Packagist) Fixed in 5.0.1 Advisory →
  • Fix · GHSA-8x3j-439w-537c mmc/ceselector (Packagist) Fixed in 4.0.2 Advisory →
  • Fix · GHSA-8x3j-439w-537c mmc/ceselector (Packagist) Fixed in 3.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46725
  2. 2026-10-03 Alias added: GHSA-8x3j-439w-537c

References

Advisory 2

Other 2

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences