CVE-2026-56095: TYPO3 SOLR Extension PHP Object Injection

CVE-2026-56095 Overview

CVE-2026-56095 is a PHP Object Injection vulnerability in a TYPO3 Solr indexer extension. The indexer passes field values returned by content object rendering through PHP's unserialize() function when transferring multi-value data. This unsafe deserialization affects the SOLR_CLASSIFICATION, SOLR_MULTIVALUE, and SOLR_RELATION content object types. When user-generated content stored in the TYPO3 database reaches an indexed field, an attacker can inject a crafted serialized payload. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and is documented in TYPO3 Security Advisory 2026-025.

Critical Impact
Successful exploitation enables PHP object injection, which can lead to arbitrary code execution, data tampering, or full compromise of the TYPO3 backend depending on available gadget chains.

Affected Products

TYPO3 Solr indexer extension (see vendor advisory for affected versions)
TYPO3 instances rendering SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types
TYPO3 sites where user-generated content can reach indexed Solr fields

Discovery Timeline

2026-08-25 - CVE-2026-56095 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56095

Vulnerability Analysis

The vulnerability originates in the Solr indexer's handling of multi-value fields. When the indexer processes SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types, it serializes and later deserializes field values using PHP's native unserialize() function. This design decision replaces a safe transport format with an unsafe one. Any string that reaches this code path is interpreted as a PHP serialized object graph. An attacker who can influence indexed field values can therefore trigger PHP magic methods such as __wakeup() or __destruct() on arbitrary classes present in the application's class loader.

Root Cause

The root cause is the use of PHP's unserialize() on values that may contain attacker-controlled data. unserialize() reconstructs object instances and invokes lifecycle methods on them. When combined with gadget chains available in TYPO3 core, third-party extensions, or Composer dependencies, this can escalate into arbitrary code execution. Safer alternatives such as JSON encoding or unserialize() with an allowed_classes allowlist were not applied to this data path.

Attack Vector

Exploitation requires an attacker to write a malicious serialized payload into a database field that is later indexed by Solr through the affected content object types. Any interface that persists user-generated content into indexed fields, including frontend forms, comments, profile data, or backend editor content, can serve as the injection vector. Once the indexer processes the record, the payload is deserialized and the gadget chain executes in the context of the TYPO3 PHP process. The attack requires low privileges but has high attack complexity due to the need for a working gadget chain and control over an indexed field.

No verified public exploit code is available. See TYPO3 Security Advisory 2026-025 for vendor-provided technical details.

Detection Methods for CVE-2026-56095

Indicators of Compromise

Database records in indexed tables containing values beginning with PHP serialization markers such as O:, a:, or C: where free-form text is expected.
Unexpected PHP errors or warnings from unserialize() in TYPO3 or Solr indexer logs.
Outbound network connections or file writes originating from the PHP-FPM or web server process during Solr indexing runs.
New or modified PHP files under the TYPO3 web root created around the time of an indexing job.

Detection Strategies

Inspect Solr indexer logs for deserialization errors, class-not-found notices, or exceptions referencing __wakeup, __destruct, or __toString.
Query the TYPO3 database for user-editable fields containing serialized-object signatures and review those rows before reindexing.
Correlate scheduler task execution for the Solr indexer with process behavior such as child process creation, shell invocation, or unexpected file system writes.

Monitoring Recommendations

Enable verbose logging on the TYPO3 Solr extension and forward logs to a centralized analytics platform for anomaly review.
Monitor web server and PHP worker processes for unusual child processes, especially during scheduled indexing windows.
Alert on writes to sensitive directories such as typo3conf/, typo3temp/, and the extension directory outside of deployment windows.

How to Mitigate CVE-2026-56095

Immediate Actions Required

Apply the patched version of the TYPO3 Solr extension as described in TYPO3 Security Advisory 2026-025.
Audit all TypoScript configurations that use SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION and identify which fields are populated from user-controlled sources.
Review the TYPO3 database for suspicious serialized payloads in indexed fields and remove or sanitize offending records before reindexing.
Rotate credentials and secrets that could have been exposed through the TYPO3 PHP process if indicators of compromise are found.

Patch Information

Refer to TYPO3 Security Advisory 2026-025 for the fixed extension versions and upgrade instructions. The patch replaces the unsafe unserialize() transport with a safe multi-value encoding for the affected content object types.

Workarounds

Disable indexing for SOLR_CLASSIFICATION, SOLR_MULTIVALUE, and SOLR_RELATION content object types until the patched extension version is deployed.
Restrict which backend user groups can edit records that flow into indexed Solr fields, reducing exposure to untrusted input.
Add input validation at the application layer to reject strings matching PHP serialization signatures in fields that should contain only free text.

bash

# Example: search TYPO3 database dumps for PHP serialized-object markers before reindexing
grep -REn 'O:[0-9]+:"[A-Za-z_\\]+":' /path/to/typo3/db_dump.sql