CVE-2026-76834

Name of the Vulnerable Software and Affected Versions b2evolution CMS versions 6.7.8 through 7.2.5

Description An incomplete fix in the param check serialized array() function fails to reject payloads containing negative integer array keys. Unauthenticated attackers can send crafted serialized PHP objects via POST requests to the 'htsrv/call plugin.php' endpoint. This allows the bypass of validation to reach the unserialize() function, enabling the instantiation of arbitrary PHP objects with attacker-controlled properties. This may lead to remote code execution if suitable POP (Property Oriented Programming) gadget chains are present.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.