CVE-2026-56095
Received Received - Intake

PHP Object Injection in TYPO3 Extension Indexer

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: TYPO3

Description
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-56095
EUVD
EUVD-2026-65350

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
typo3 apache_solr_for_typo3 to 11.6.6 (exc)
typo3 apache_solr_for_typo3 From 12.0.0 (inc) to 12.1.4 (exc)
typo3 apache_solr_for_typo3 From 13.0.0 (inc) to 13.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Apache Solr for TYPO3 extension improperly handling user-generated content during indexing. The extension passes field values through PHP's unserialize() function for certain content types, creating a PHP Object Injection risk if malicious data reaches indexed fields.

Detection Guidance

Check if your Apache Solr for TYPO3 extension version is 11.6.5 or below, 12.0.0 to 12.1.3, or 13.0.0 to 13.1.3. Use commands like 'composer show typo3-solr' or check the extension manager in TYPO3 backend to verify the version.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server by injecting malicious serialized PHP objects. This may lead to full system compromise, data theft, or unauthorized access to sensitive information stored in the TYPO3 database or Solr index.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update the Apache Solr for TYPO3 extension to versions 11.6.6, 12.1.4, or 13.1.4 immediately. Remove or restrict access to untrusted users until the update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart