The TYPO3 Site Crawler extension improperly handles the X-T3Crawler-Meta response header by passing it directly to PHP's unserialize() function without validation. This CWE-502 vulnerability enables an attacker controlling a crawled endpoint to inject malicious serialized PHP objects. Successful exploitation can lead to remote code execution on the TYPO3 server. However, exploitation requires administrative privileges to set up a crawler-enabled page and trigger the crawl through a Scheduler task. The vulnerability is identified as CVE-2026-8727 with a CVSS 4.0 score of 7.1 (high severity). No patch or official remediation is currently documented.

An attacker with administrative privileges can exploit this vulnerability to achieve remote code execution on the TYPO3 server by injecting arbitrary serialized PHP objects via the X-T3Crawler-Meta response header. This could lead to full compromise of the affected system. However, the attack requires high privileges and user interaction to trigger the Scheduler task.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid configuring crawler-enabled pages that crawl attacker-controlled endpoints. Monitor TYPO3 vendor communications for updates on patches or mitigations.