LOWVulnerability
CVE-2026-77138
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Properties
- last_source
- NVD
- cve_id
- CVE-2026-77138
- signal_observed_at
- 2026-09-29T00:56:27+00:00
- retrieved_at
- 2026-09-29T00:56:27+00:00
- published_at
- 2026-08-25T09:17:34.497
- last_modified
- 2026-09-28T23:10:00.143
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Deserialization of Untrusted Data
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph