TYPO3’s VariableFrontend cache and Registry key‑value store deserialize PHP payloads without integrity checks or class restrictions, creating a PHP Object Injection flaw. An attacker with write access to the cache backend or the sys_registry database can inject a crafted payload that may trigger a gadget chain, leading to remote code execution or other serious impacts. The flaw is grounded in CWE‑502, which highlights unsafe deserialization.

TYPO3 CMS installations running any version prior to 10.4.57, 11.0.0‑11.5.51, 12.0.0‑12.4.46, 13.0.0‑13.4.31 or 14.0.0‑14.3.3 are impacted. The vulnerability resides in the core API that handles cache and registry serialization.

The CVSS score of 6.3 indicates a moderate severity, yet the potential for remote code execution makes the risk higher. The EPSS score is not available, and the entry is not listed in the CISA KEV catalog. Exploitation requires direct local write access to the storage medium—either the SQL database or the file system—if an attacker can write to the cache store or sys_registry table, the vulnerability becomes exploitable. The likely attack vector is a local compromise that upgrades the attacker’s privileges to write to the backend storage.