CVE-2026-8727: TYPO3 Site Crawler insecure deserialization in X-T3Crawler-Meta header

CVE-2026-8727 · Severity: high · CVSS 4 · Published 2026-05-19

The TYPO3 Site Crawler extension, used to automate page indexing and cache management, is vulnerable to a flaw that allows an attacker to take full control of the web server. By controlling a website that the crawler visits, an attacker can execute malicious code on the TYPO3 server. This could lead to total data theft, service disruption, or unauthorized access to internal systems.

Vendors: Packagist, Typo3.

Quick answers

Is CVE-2026-8727 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8727 being exploited in the wild.
How severe is CVE-2026-8727?
High severity, with a CVSS score of 4, published 19 May 2026.
Which products and versions are affected?
tomasnorre/crawler (Packagist) ECOSYSTEM:introduced=12.0.0,fixed=12.0.11; Typo3 Crawler >= 12.0.0, < 12.0.11, 12.0.0 - 12.0.10, 11.0.12 and below.
Is there a fix for CVE-2026-8727?
Yes. tomasnorre/crawler (Packagist): upgrade to 12.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8727 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8727?
Check whether you run tomasnorre/crawler (Packagist) or Typo3 Crawler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tomasnorre/crawler (Packagist): upgrade to 12.0.11 or later
    composer require tomasnorre/crawler:^12.0.11

Technical details

The TYPO3 Crawler (crawler) extension is vulnerable to insecure deserialization (CWE-502). The extension retrieves the 'X-T3Crawler-Meta' response header from crawled URLs and passes it directly to PHP's unserialize() function without validation. An attacker who can control the content of a crawled endpoint can provide a malicious serialized payload to achieve Remote Code Execution (RCE). Exploitation is complex as it requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. The vulnerability is patched in versions 12.0.11 and 11.0.13.

Affected products

  • TYPO3 crawler >= 12.0.0, < 12.0.11
  • TYPO3 crawler < 11.0.13

Identifiers

  • CVE-2026-8727
  • GHSA-jr8m-x4p7-p3v5

Timeline

  • 2026-05-19: disclosed
  • 2026-05-19: advisory
  • 2026-05-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.