The TYPO3 extension "Apache Solr for TYPO3 - Enterprise Search" improperly uses PHP's unserialize() function on every field value returned by content object rendering for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE, and SOLR_RELATION content object types. This unsafe deserialization of potentially user-controlled data can lead to PHP Object Injection vulnerabilities. The issue arises when user-generated content stored in the TYPO3 database is indexed, allowing malicious input to trigger unsafe unserialization.

Successful exploitation could allow an attacker with low privileges and partial access (AT:P, PR:L) to perform PHP Object Injection, potentially leading to code execution or other impacts depending on the application context. The CVSS 4.0 base score is 7.7 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Users should monitor TYPO3 vendor advisories for patches addressing this unsafe deserialization vulnerability.