Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

tomasnorre/crawler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1PackagistPublished

    TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

    CVE-2026-8727 · GHSA-jr8m-x4p7-p3v5

    Affected
    • Packagist tomasnorre/crawler >= 12.0.0, < 12.0.11; < 11.0.13
    Fixed in
    11.0.1312.0.11· Vendor fix available
    Issue
    The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.

    Recommended action: Upgrade to 12.0.11 or 11.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →