CVE-2026-77138: TYPO3 Extension RCE Vulnerability

CVE-2026-77138 Overview

CVE-2026-77138 is a critical insecure deserialization vulnerability affecting a TYPO3 extension. The extension passes attacker-controlled cookie data directly to PHP's unserialize() function without validation. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, resulting in Remote Code Execution on the TYPO3 server. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and documented in TYPO3 Security Advisory 2026-014.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary code execution on TYPO3 servers by supplying a malicious cookie value.

Affected Products

TYPO3 third-party extension referenced in TYPO3 Security Advisory 2026-014
TYPO3 CMS installations that load the vulnerable extension
Versions prior to the fixed release published in the advisory

Discovery Timeline

2026-08-25 - CVE-2026-77138 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77138

Vulnerability Analysis

The vulnerability arises because the extension reads a client-supplied cookie value and forwards it to PHP's unserialize() function. unserialize() reconstructs PHP objects from their serialized representation and invokes magic methods such as __wakeup(), __destruct(), and __toString() during that reconstruction. An attacker who controls the serialized data can therefore instantiate arbitrary classes already loaded within the TYPO3 runtime and trigger their magic methods with attacker-chosen properties.

By chaining magic methods across classes present in TYPO3 core, extensions, or Composer dependencies, an attacker can build a POP (Property-Oriented Programming) gadget chain. Such chains typically escalate from object instantiation to file writes, SQL queries, or command execution, ultimately achieving Remote Code Execution under the web server user.

Root Cause

The root cause is direct invocation of unserialize() on untrusted client input, without integrity verification or type restriction. Cookies are attacker-controlled by design, and PHP deserialization performs implicit object construction with side effects. No signed token, HMAC validation, or allowed_classes restriction is applied before parsing.

Attack Vector

Exploitation requires only network access to the TYPO3 site. The attacker sends an HTTP request that includes a crafted Cookie header carrying a serialized PHP payload. When the vulnerable extension processes the request, it decodes and deserializes the cookie value, triggering the gadget chain. No authentication, user interaction, or prior access is required, and the request can be delivered by any HTTP client.

Refer to TYPO3 Security Advisory 2026-014 for the specific affected extension and vulnerable code paths.

Detection Methods for CVE-2026-77138

Indicators of Compromise

HTTP requests containing Cookie header values that begin with PHP serialization tokens such as O:, a:, or s: followed by class names and property counts
Web server or PHP error logs referencing unserialize(), __wakeup, or __destruct warnings tied to request processing
Unexpected child processes spawned by the PHP-FPM or web server user, such as /bin/sh, bash, curl, or wget
New or modified PHP files in typo3conf/, typo3temp/, or extension directories that were not deployed by administrators

Detection Strategies

Inspect inbound HTTP traffic at the WAF or reverse proxy for cookie values matching PHP serialized-object patterns and block or alert on matches
Correlate web access logs with process-execution telemetry to identify PHP worker processes launching shells or network utilities
Audit installed TYPO3 extensions against the version listed in TYPO3 Security Advisory 2026-014 to identify vulnerable deployments

Monitoring Recommendations

Enable PHP error and exception logging and forward logs to a centralized SIEM for alerting on deserialization warnings
Monitor file integrity on the TYPO3 document root and extension directories to detect webshell drops
Track outbound network connections from web server hosts to catch reverse shells or payload retrieval

How to Mitigate CVE-2026-77138

Immediate Actions Required

Apply the patched extension release referenced in TYPO3 Security Advisory 2026-014 as soon as it is available
Remove or disable the affected extension in the TYPO3 Extension Manager until it can be updated
Rotate TYPO3 encryption keys, backend credentials, and any secrets accessible from the web server after patching
Review web server, PHP-FPM, and TYPO3 logs for signs of prior exploitation attempts

Patch Information

Install the fixed extension version identified in TYPO3 Security Advisory 2026-014. The advisory lists the vulnerable and remediated versions along with upgrade instructions. Verify integrity of the TYPO3 installation after upgrade and confirm the extension version through the Extension Manager or composer show.

Workarounds

Block or strip the specific cookie processed by the vulnerable extension at the reverse proxy or WAF layer
Deploy a WAF rule that rejects requests whose cookie values match PHP serialization signatures such as ^O:\d+:"
Restrict access to the affected TYPO3 site to trusted IP ranges until the patch is applied
If code changes are feasible, replace unserialize($input) with unserialize($input, ['allowed_classes' => false]) or with a JSON-based alternative

bash

# Example ModSecurity rule to block PHP serialized objects in cookies
SecRule REQUEST_COOKIES "@rx ^\s*O:\d+:\"[A-Za-z_\\\\][A-Za-z0-9_\\\\]*\":\d+:\{" \
    "id:1077138,phase:1,deny,status:403,log,\
     msg:'CVE-2026-77138: PHP serialized object detected in cookie'"