PT-2026-146446

CVE-2026-59081

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

8.4

High

MetricsAV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.

This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Exploitability

Fix

Impacts

Researchers

Dawid Małecki

Michał Majchrowicz

Paweł Zdunek

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data