CVE-2026-59978

Name of the Vulnerable Software and Affected Versions AdminNeo versions 4.6.2 through 5.4.9

Description The ?script=version endpoint accepts POST data without origin, CSRF, or parameter-type validation. A remote attacker can provide a version[] parameter, which is processed as a PHP array and serialized into the adminneo.version shared cache by bootstrap.inc.php. Subsequently, design.inc.php passes this cached value to the cookie() and rawurlencode() functions, resulting in a TypeError because the functions expect a string rather than an array. This leads to a Denial of Service where the instance returns HTTP 500 errors to all users for twenty-four hours or until the cache is cleared. This occurs if the web server has write permissions for the shared cache.

Recommendations Update to version 5.5.0. As an interim workaround, configure the web server to make the shared cache unwritable.