Executive brief
The Apache Solr for TYPO3 extension uses unsafe PHP deserialization when processing multi-value data during content indexing. If user-generated content reaches indexed fields, attackers can inject malicious PHP objects to achieve remote code execution, compromising the TYPO3 installation and customer data.
Technical details
The vulnerability is an insecure deserialization flaw (CWE-502) in the extension's indexer component. When handling multi-value content object types (SOLR_CLASSIFICATION, SOLR_MULTIVALUE, and SOLR_RELATION), the indexer passes field values through PHP's unserialize() function instead of using a safe serialization format. If user-generated content from the TYPO3 database reaches an indexed field, an attacker can craft a malicious serialized PHP object that will be unserialized during indexing, triggering PHP Object Injection. This can lead to arbitrary code execution depending on available gadget chains in the application. The attack requires the attacker to control content saved in the TYPO3 database (e.g., via form submissions, comments, or other user input fields). Patched versions 11.2.8, 11.6.6, 12.1.4, and 13.1.4 are available.
Affected products
- Apache Solr for TYPO3 Apache Solr for TYPO3 - Enterprise Search 11.2.7 and below, 11.5.0-11.6.5, 12.0.0-12.1.3, 13.0.0-13.1.3
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Versions 11.2.8, 11.6.6, 12.1.4, 13.1.4 released