The TYPO3 extension "Content Element Selector" directly passes an attacker‑controlled cookie to PHP’s unserialize() function without input sanitization. This PHP Object Injection flaw allows a remote, unauthenticated attacker to supply a crafted serialized payload that obtains arbitrary code execution on the TYPO3 server. The impact is thus full control over the affected host, with potential to modify, delete, or exfiltrate data, install malware, or pivot within the network.

Any TYPO3 deployment that has the "Content Element Selector" extension installed is vulnerable. No specific version range is provided in the advisory, so all released versions are at risk until patched. The vulnerability is triggered only when the plugin is configured with Persistent Mode set to Static.

The CVSS score of 9.2 classifies this as a critical vulnerability, while the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires the Persistent Mode: Static setting, but an attacker can achieve this by simply delivering a crafted cookie in an HTTP request, which is feasible from any network location. Given the high severity and remote unauthenticated nature, the risk of exploitation is significant.