CVE-2026-46725: TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
The TYPO3 "Content Element Selector" (ceselector) extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Published May 19, 2026 · Updated Jun 29, 2026
Affected packages
mmc/ceselector
- Ecosystem
- Composer (PHP)
- Affected
- >= 6.0.0, < 6.0.1
- Fixed in
- 6.0.1
- Check
composer show mmc/ceselector
mmc/ceselector
- Ecosystem
- Composer (PHP)
- Affected
- >= 5.0.0, < 5.0.1
- Fixed in
- 5.0.1
- Check
composer show mmc/ceselector
mmc/ceselector
- Ecosystem
- Composer (PHP)
- Affected
- >= 4.0.0, < 4.0.2
- Fixed in
- 4.0.2
- Check
composer show mmc/ceselector
mmc/ceselector
- Ecosystem
- Composer (PHP)
- Affected
- < 3.0.3
- Fixed in
- 3.0.3
- Check
composer show mmc/ceselector
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The TYPO3 "Content Element Selector" (ceselector) extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with Persistent Mode: Static in the plugin settings. This has been patched in version 3.0.3, 4.0.2, 5.0.1, and 6.0.1.
Credited to eliashaeussler.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology