The TYPO3 extension "Content Element Selector" passes a cookie directly to PHP’s unserialize() function without validating or sanitizing the data. This PHP Object Injection flaw permits a remote, unauthenticated attacker to supply a crafted serialized payload that can execute arbitrary code on the TYPO3 server. The vulnerability enables full control over the affected host, potentially allowing attacker‑initiated modifications, data exfiltration, or further network pivots.

Any TYPO3 deployment that has the "Content Element Selector" extension installed is potentially affected. The advisory does not list a specific version range, so the vulnerability may exist in any released version until a patch is applied. The exploit requires the plugin to be configured with "Persistent Mode: Static" in its settings.

The CVSS score of 9.2 indicates a critical level of risk, while the EPSS score of 3% shows a moderate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the attacker only needs to send a crafted cookie in an HTTP request, the attack vector is feasible from any network location, making the risk of exploitation significant.