PT-2026-144975
CVE-2026-59192
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
TwigView plugin for CakePHP versions prior to 1.3.3
TwigView plugin for CakePHP versions prior to 2.1.2
Description
The
unserialize filter lacks restrictions on allowed classes, which can be utilized as a deserialization remote-code-execution gadget. Deserialization is the process of converting a stored data format back into an object, and a gadget is a piece of code within a library that can be leveraged to achieve an unintended effect during this process.Recommendations
Update TwigView plugin for CakePHP to version 1.3.3 or later.
Update TwigView plugin for CakePHP to version 2.1.2 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾