-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from the combination of TYPO3's Form Framework using the PECL yaml extension with the 'yaml.decode_php' setting enabled (default). This allows yaml_parse() to deserialize PHP objects via YAML's !php/object tags. The advisory explicitly links the vulnerability to this configuration and YAML processing in the form extension. While the exact file path isn't provided in available resources, yaml_parse() is the core function enabling object deserialization in this context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 8.5.0, < 8.7.17 | 8.7.17 |
| typo3/cms | composer | >= 9.0.0, < 9.3.2 | 9.3.2 |