The TYPO3 extension "Content Element Selector" versions 0, 4.0.0, 5.0.0, and 6.0.0 contain a deserialization vulnerability (CWE-502) where an attacker-controlled cookie is passed directly to PHP's unserialize() without validation or sanitization. This allows a remote, unauthenticated attacker to perform PHP Object Injection by sending a crafted serialized payload. Successful exploitation can lead to Remote Code Execution on the server hosting TYPO3. The attack vector requires the extension's "Persistent Mode: Static" setting to be enabled in the plugin configuration. The vulnerability was published on 2026-05-19 with a CVSS 4.0 base score of 9.2, reflecting critical impact. No vendor advisory or patch information is currently provided.

This vulnerability enables remote, unauthenticated attackers to execute arbitrary code on TYPO3 servers running the affected extension with specific configuration. The impact includes full compromise of the server hosting the TYPO3 instance, potentially leading to data theft, service disruption, or further network compromise. The high CVSS score (9.2) reflects the ease of exploitation (network attack vector, no privileges or user interaction required) and the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or reconfiguring the "Content Element Selector" extension to avoid using "Persistent Mode: Static". Monitoring vendor channels for updates is recommended. Avoid exposing vulnerable TYPO3 instances to untrusted networks if possible.