TYPO3 CMS's VariableFrontend cache and Registry persistent key-value store deserialize PHP payloads without validating integrity or restricting classes. This allows an attacker with write access to the storage backend (cache or sys_registry database) to inject crafted serialized payloads. Such payloads can trigger PHP Object Injection, potentially exploiting gadget chains to achieve remote code execution or other high-impact effects. Exploitation requires local write access to the storage, such as the SQL database or file system. The vulnerability affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

An attacker with local write access to the TYPO3 CMS cache or sys_registry storage can inject malicious serialized PHP objects, leading to PHP Object Injection. This can result in remote code execution or other severe impacts depending on the gadget chain exploited. The vulnerability requires local write privileges and does not allow remote exploitation without such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or updates are confirmed, restrict write access to the underlying storage backends such as the cache store and sys_registry database table to trusted users only. Monitor for vendor updates and apply official fixes once available.