7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8727

CVE-2026-8727: Remote Code Execution in extension "Site Crawler" (crawler)

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8727

CVE-2026-8727:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tomasnorre/crawler	composer	>= 12.0.0, < 12.0.11	12.0.11
tomasnorre/crawler	composer	< 11.0.13	11.0.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of insecure deserialization (CWE-502). The TYPO3 extension "crawler" uses PHP's serialize() and unserialize() functions to exchange metadata during the crawling process via the X-T3Crawler-Meta HTTP header. The core of the vulnerability lies in the fetchUrlContents method within the GuzzleExecutionStrategy class, where the content of the X-T3Crawler-Meta header from a crawled URL is passed directly to unserialize(). An attacker who can control the content of a crawled endpoint can inject a malicious, serialized PHP object into this header. When the crawler processes this header, the unserialize() call triggers a PHP Object Injection, which can be leveraged for Remote Code Execution on the server running TYPO3. The security patch, found in commit 2713c27ae4eb856d358c266a4e3189341d84c6d7, mitigates this by replacing the unsafe serialize()/unserialize() mechanism with the safer json_encode()/json_decode() functions, which do not carry the risk of object instantiation and code execution during decoding.

Vulnerable functions

TomasNorre\Crawler\CrawlStrategy\GuzzleExecutionStrategy::fetchUrlContents

Classes/CrawlStrategy/GuzzleExecutionStrategy.php

This function is responsible for fetching the content of a URL. It retrieves the 'X-T3Crawler-Meta' header from the HTTP response and passes its value directly to the `unserialize()` function. An attacker controlling the crawled URL can craft a malicious serialized PHP object in this header, which, when deserialized, can lead to object injection and remote code execution.

TomasNorre\Crawler\Middleware\CrawlerInitialization::process

Classes/Middleware/CrawlerInitialization.php

This function is part of the process that generates the data to be crawled. It was modified to use `json_encode` instead of `serialize` to create the 'X-T3Crawler-Meta' header. While not the point of deserialization, it is a key part of the vulnerable data flow that was changed in the patch.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.