Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-56095

Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search"

Default version status: unaffected

  • 13.0.0 to < 13.1.4affected
  • 12.0.0 to < 12.1.4affected
  • 11.5.0 to < 11.6.6affected

References