Read the docs
TI-2026-40485 Aliases CVE-2026-56095GHSA-r2vh-j53r-xpr5

Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

Priority LOW 36CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed Extension "Apache Solr for TYPO3 - Enterprise Search" (TYPO3): 13.1.4, 12.1.4, 11.6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "Apache Solr for TYPO3 - Enterprise Search"13.0.0 to before 13.1.4; 12.0.0 to before 12.1.4; 11.5.0 to before 11.6.613.1.4, 12.1.4, 11.6.6Patch availableCNA
  • Extension "Apache Solr for TYPO3 - Enterprise Search" VendorTYPO3 Affected 13.0.0 to before 13.1.4; 12.0.0 to before 12.1.4; 11.5.0 to before 11.6.6 Fixed in 13.1.4, 12.1.4, 11.6.6 Patch available CNA

Remediation

  • Fix · CNA Extension "Apache Solr for TYPO3 - Enterprise Search" (TYPO3) Fixed in 13.1.4, 12.1.4, 11.6.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" — typo3.org/security/advisory/typo3-ext-sa-2026-025

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-40482 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 35
    • TI-2026-40486 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 28
    • TI-2026-40484 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Priority LOW 28
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56095
  2. 2026-10-03 Alias added: GHSA-r2vh-j53r-xpr5

References

Advisory 1

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences