CVE-2026-8727 Remote Code Execution in extension "Site Crawler" (crawler)
An attacker with admin privileges can achieve remote code execution on TYPO3 servers by injecting malicious serialized objects into crawled responses.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-8727?
CVE-2026-8727 is a high-severity unsafe deserialization vulnerability in TYPO3 Extension "Site Crawler", published on 19 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
Weakness: CWE-502
Which versions are affected by CVE-2026-8727?
4 open source packages ship an affected version, including tomasnorre/crawler.
| Package | Affected | Fixed in |
|---|---|---|
tomasnorre/crawler Packagist | All versions | 11.0.13 |
tomasnorre/crawler Packagist | All versions | 11.0.13 |
tomasnorre/crawler Packagist | From 12.0.0 | 12.0.11 |
tomasnorre/crawler Packagist | From 12.0.0 | 12.0.11 |
How do I fix CVE-2026-8727?
Upgrade tomasnorre/crawler to a fixed version for your release line: 11.0.13 or 12.0.11.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-8727 being exploited?
There is no known exploitation of CVE-2026-8727 in the wild and no public exploit code.
Sources
Also known as GHSA-jr8m-x4p7-p3v5.