xxconi/CVE-2026-46275

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-46725, an insecure deserialization vulnerability in the TYPO3 ceselector extension. The script detects the extension via a Set-Cookie header, constructs a PHP object injection payload using a Monolog gadget chain, sends it in a cookie to trigger unserialize(), and extracts command output to achieve remote code execution. It supports single-target exploitation, bulk scanning, and an interactive shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python proof-of-concept exploit for CVE-2026-46725, a TYPO3 ceselector extension insecure deserialization vulnerability. The code performs HTTP requests to detect the target, sends a PHP object injection payload via a cookie, and extracts command output from the response. No backdoor, concealed operator-directed harm, persistence, credential theft, or unrelated payload was observed. The artifact's behavior is consistent with a standard public exploit PoC.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareTYPO3 ceselector extension
Attack typesinsecure_deserializationremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is an exploit because it actively delivers a crafted payload to a target system to achieve remote code execution. The code constructs a PHP object injection payload (lines 325-364), sends it in an HTTP cookie (lines 486-498), and extracts the resulting command output (lines 397-426). It includes an interactive shell for repeated command execution (lines 646-732). This goes beyond detection or scanning; it exercises the vulnerability to execute arbitrary OS commands.

CVE-2026-46275.py:325-364CVE-2026-46275.py:486-498CVE-2026-46275.py:397-426CVE-2026-46275.py:646-732

Requirements

  • Target must have TYPO3 with the ceselector extension installed and the T3_ceselector_* cookie present in the Set-Cookie header.CVE-2026-46275.py:218-315
  • The TYPO3 configuration must have Persistent Mode: Static enabled for the vulnerability to be exploitable.README.md:48

Observed behavior

  • Sends an HTTP GET request to the target to detect TYPO3 and extract the T3_ceselector_* cookie name from the Set-Cookie header.CVE-2026-46275.py:231-315
  • Constructs a URL-encoded PHP serialized object (Monolog gadget chain) that executes an arbitrary OS command via system() when unserialized.CVE-2026-46275.py:325-364
  • Sends a second HTTP GET request with the malicious payload in the T3_ceselector_* cookie to trigger the deserialization vulnerability.CVE-2026-46275.py:486-498
  • Extracts and displays the command output from the HTTP response body using regex patterns (e.g., uid=... for the id command).CVE-2026-46275.py:397-426
  • Provides an interactive shell that repeatedly sends commands via the cookie and displays the output.CVE-2026-46275.py:646-732
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
PHP Object Injection via Monolog gadget chainThe exploit sends a serialized PHP object in a cookie to trigger remote code execution on a vulnerable TYPO3 instance.CVE-2026-46275.py:325-364cve-2026-46275-v2.py:228-276
Command Execution
system() via deserializationThe payload uses a Monolog gadget chain ending in a call to system() with a user-supplied command.CVE-2026-46275.py:325-349cve-2026-46275-v2.py:247-273
Network Behavior
HTTP GET requests to user-supplied targetThe script sends HTTP GET requests to the target URL with a malicious cookie to exploit the vulnerability.CVE-2026-46275.py:486-498cve-2026-46275-v2.py:560-573
Interactive Shell
Provides an interactive command shell on successful exploitationThe script includes an interactive shell feature that repeatedly sends commands to the compromised server.CVE-2026-46275.py:646-732cve-2026-46275-v2.py:729-818
Review boundaries

What the analysis did not establish

  • The evidence includes two Python scripts (CVE-2026-46275.py and cve-2026-46275-v2.py) that appear to be versions of the same exploit; only the first was analyzed in detail.
  • The CVE context provided in the envelope is for CVE-2026-46275 (a Linux kernel Bluetooth vulnerability), but the artifact's code and README consistently reference CVE-2026-46725 (TYPO3 ceselector). This mismatch is noted but does not affect classification of the artifact's behavior.
  • The artifact's code was not executed; classification is based solely on static analysis of the provided source code.
  • Only the three text files in the repository were reviewed; no binary files were present or analyzed.
  • The review does not assess the safety or reliability of the exploit code when executed against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1