CyberRota Analysis
AI-GeneratedThe vulnerability arises from the improper handling of user-generated content in TYPO3, where the indexer uses PHP's unserialize() function on data that may be manipulated by attackers. This flaw can lead to PHP Object Injection, potentially allowing an attacker to execute arbitrary code or manipulate the application. Organizations using TYPO3 should prioritize addressing this vulnerability to safeguard against exploitation, particularly those handling untrusted input in their content management systems.
Original NVD Description
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.