CVE-2026-56095— Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Quick assessment
Affected
TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search"
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
该扩展的索引器在传输 SOLR_CLASSIFICATION、SOLR_MULTIVALUE 和 SOLR_RELATION 内容对象类型的多值数据时，未采用安全格式，而是将内容对象渲染返回的所有字段值直接传入 PHP 的 unserialize() 函数进行反序列化。如果保存在 TYPO3 数据库中的用户生成内容能够被索引到某个字段中，就会暴露 PHP 对象注入攻击面。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TYPO3 | Extension "Apache Solr for TYPO3 - Enterprise Search" | 13.0.0< 13.1.4 |
affected |
12.0.0< 12.1.4 |
affected | ||
< 11.6.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
Source: CVE Program / CVE List V5
Vulnerability Description
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TYPO3 | Extension "Apache Solr for TYPO3 - Enterprise Search" | 13.0.0 ~ 13.1.4 | - |
|
II. Public POCs for CVE-2026-56095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56095
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56095 (1)
Same Patch Batch · TYPO3 · 2026-08-25 · 24 CVEs total
| CVE-2026-77136 | 9.5 CRITICAL | Server-Side Template Injection in extension "powermail" (powermail) |
| CVE-2026-77138 | 9.3 CRITICAL | Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_po |
| CVE-2026-77142 | 8.8 HIGH | Broken Access Control in extension "Industry Directory" (yellowpages2) |
| CVE-2026-77143 | 8.8 HIGH | Broken Access Control in extension "Forum" (pforum) |
| CVE-2026-77141 | 8.8 HIGH | Broken Access Control in extension "Club Directory" (clubdirectory) |
| CVE-2026-77140 | 8.7 HIGH | Broken Access Control in extension "Telephone Directory" (telephonedirectory) |
| CVE-2026-77146 | 8.3 HIGH | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77134 | 8.3 HIGH | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77135 | 8.2 HIGH | Information Disclosure in extension "femanager" (femanager) |
| CVE-2026-77129 | 7.7 HIGH | Server-Side Template Injection in extension "Event management and registration" (sf_event_ |
| CVE-2026-77137 | 7.7 HIGH | SQL Injection in extension "Forms Export" (frp_form_answers) |
| CVE-2026-56092 | 7.6 HIGH | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-77144 | 7.1 HIGH | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-77145 | 7.1 HIGH | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-56094 | 6.3 MEDIUM | Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56093 | 6.3 MEDIUM | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56096 | 6.3 MEDIUM | Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-77128 | 6.3 MEDIUM | Broken Access Control in extension "Event management and registration" (sf_event_mgt) |
| CVE-2026-77139 | 6.0 MEDIUM | Path Traversal in extension "Mask" (mask) |
| CVE-2026-77127 | 6.0 MEDIUM | Information Disclosure in extension "Modules" (modules) |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Extension "Apache Solr for TYPO3 - Enterprise Search"
-
CVE-2026-56092
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56093
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-56096
Information Disclosure in extension "Apache Solr for TYPO3 -
Same vendor: TYPO3
-
CVE-2026-56092
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56093
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-56096
Information Disclosure in extension "Apache Solr for TYPO3 - -
CVE-2026-77127
Information Disclosure in extension "Modules" (modules)
Same weakness: CWE-502
-
CVE-2026-79657
NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle D -
CVE-2026-78572
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injectio -
CVE-2026-77138
Remote Code Execution in extension "HTML5 Video Player vs. P -
CVE-2026-78683
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle D -
CVE-2026-78265
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object
V. Comments for CVE-2026-56095
No comments yet