CVE-2026-46725 is a critical vulnerability in the TYPO3 extension "Content Element Selector" where an attacker-controlled cookie is passed directly to PHP's unserialize() without validation or sanitization. This unsafe deserialization leads to PHP Object Injection, enabling remote code execution. The attack vector is remote and unauthenticated, but exploitation depends on the plugin being configured with "Persistent Mode: Static." The CVSS 4.0 base score is 9.2, indicating high impact and ease of exploitation under the specified conditions. No patch or official remediation is currently documented.

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code on the TYPO3 server, potentially leading to full system compromise. The vulnerability arises from unsafe deserialization of untrusted data, which can be leveraged for PHP Object Injection attacks. The impact is critical due to the possibility of remote code execution without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid configuring the "Content Element Selector" plugin with "Persistent Mode: Static" or disable the extension if possible. Monitoring for updates from TYPO3 is recommended to apply any forthcoming patches promptly.