TYPO3’s VariableFrontend cache and Registry key‑value store deserialize PHP payloads without integrity checks or class restrictions, creating an insecure deserialization flaw. An attacker who can write to the cache store or the sys_registry table can inject a crafted serialized payload, which may trigger a PHP Object Injection and potentially exploit a gadget chain for remote code execution or other high‑impact effects. This issue is present in TYPO3 CMS versions prior to 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30, and 14.0.0‑14.3.2.

TYPO3 CMS installations running any version prior to 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 or 14.0.0‑14.3.2 are impacted. The vulnerability resides in the core API that handles cache and registry serialization.

The CVSS score of 6.3 indicates a moderate severity, yet the potential for remote code execution makes the risk higher. The EPSS score is < 1%, indicating a low but non‑zero probability of exploitation, and the entry is not listed in the CISA KEV catalog. Exploitation requires direct local write access to the storage medium—either the SQL database or the file system—if an attacker can write to the cache store or sys_registry table, the vulnerability becomes exploitable. The likely attack vector is a local compromise that upgrades the attacker’s privileges to write to the backend storage.