Threats affecting pkg:composer/typo3/content-element-selector

A critical deserialization vulnerability exists in the TYPO3 extension "Content Element Selector". The extension unsafely passes an attacker-controlled cookie directly to PHP's unserialize() function. This allows a remote, unauthenticated attacker to supply a crafted serialized payload that can trigger PHP Object Injection and potentially achieve Remote Code Execution on the TYPO3 server. Exploitation requires the plugin to be configured with "Persistent Mode: Static."