CVE-2026-36471

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2

Description Deserialization of untrusted data occurs within the cn parse url() function. A remote attacker can inject arbitrary values into internal request variables, such as referer, by submitting a crafted base64-encoded serialized PHP payload through the post data parameter via a POST request. Deserialization is the process of converting a formatted string back into an object or data structure.

Recommendations As a temporary workaround, restrict the use of the post data parameter in the cn parse url() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.