The Site Crawler extension in TYPO3 contains a flaw where it sends the X‑T3Crawler‑Meta header from external URLs directly into PHP's unserialize() function. Because unserialize() will instantiate any malicious PHP object passed into it, a attacker who can control a URL visited by the crawler can inject arbitrary serialized objects. The impact is that the attacker can execute arbitrary PHP code on the server, giving full control over the installation. The weakness is a deserialization vulnerability (CWE‑502).

TYPO3 installations that have the Site Crawler extension installed. No specific version numbers are listed in the advisory, so all current releases of the Site Crawler extension should be considered affected.

The CVSS score is 7.1, indicating a high severity. The exploit requires a crawler‑enabled page to be configured, which in turn needs administrative privileges, and a Scheduler task must trigger the crawl. Because administrative access is required, the attack surface is limited to sites with such permissions, but once achieved it results in full remote code execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers will need to set up a malicious endpoint and seed a crawl to succeed.