TYPO3’s cache frontend (VariableFrontend) and persistent key‑value store (Registry) deserialized PHP payloads without integrity validation or class restrictions, exposing a PHP Object Injection flaw (CWE‑502). An attacker with write access to the underlying storage backend (cache store or sys_registry database table) can inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high‑impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 and 14.0.0‑14.3.2.

TYPO3 CMS installations running any version prior to 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 or 14.0.0‑14.3.2 are impacted. The vulnerability resides in the core API that handles cache and registry serialization.

The CVSS score of 6.3 indicates a moderate severity, yet the potential for remote code execution makes the risk higher. The EPSS score is < 1%, indicating a low but non‑zero probability of exploitation, and the entry is not listed in the CISA KEV catalog. Exploitation requires direct local write access to the storage medium—either the SQL database or the file system—if an attacker can write to the cache store or sys_registry table, the vulnerability becomes exploitable. The likely attack vector is a local compromise that upgrades the attacker’s privileges to write to the backend storage.