The TYPO3 Site Crawler extension improperly handles the X-T3Crawler-Meta response header by passing its content directly to PHP's unserialize() function without validation. This unsafe deserialization (CWE-502) allows an attacker controlling the crawled URL to inject arbitrary serialized PHP objects. Successful exploitation requires administrative privileges to set up a crawler-enabled page and initiate crawling through a Scheduler task, potentially resulting in remote code execution on the server hosting TYPO3.

If exploited, this vulnerability allows remote code execution on the TYPO3 server, which can lead to full compromise of the affected system. However, exploitation requires high privileges (administrative access) and user interaction to trigger the crawl, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and avoid enabling or scheduling crawler tasks that process untrusted URLs. Monitor TYPO3 vendor communications for updates on patches or official mitigations.