TYPO3 CMS's VariableFrontend cache and Registry persistent key-value store deserialize PHP payloads without validating integrity or restricting classes. This allows an attacker with write access to the underlying storage (cache or sys_registry database table) to inject crafted serialized payloads. Exploitation could trigger PHP Object Injection and potentially remote code execution via gadget chains. The vulnerability affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31, and 14.0.0-14.3.3. Exploitation requires local write access to the storage backend, such as the SQL database or filesystem.

An attacker with write access to TYPO3 CMS's cache or sys_registry storage backend can inject malicious serialized PHP payloads. This can lead to PHP Object Injection, which may be leveraged to execute arbitrary code remotely or cause other high-impact effects. The vulnerability requires local write access, limiting remote exploitation scenarios. The CVSS 4.0 score is 6.3 (medium severity), reflecting the need for local privileges and the potential for significant impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor TYPO3 vendor advisories for updates. Mitigation involves restricting write access to the cache storage backend and sys_registry database table to trusted users only. Avoid allowing untrusted users to write serialized data to these storage locations. Apply any official patches once available.