CVE-2026-104747

Summary

A PHP object injection vulnerability exists in Haaken versions up to 1.5 that allows unauthenticated attackers to inject malicious PHP objects, potentially leading to remote code execution or data compromise.

Exploitability

Exploitation requires crafting a serialized PHP object payload and sending it to the vulnerable endpoint, which is moderately difficult without additional preconditions but possible for attackers with basic PHP knowledge.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, potentially leading to full system compromise or unauthorized access to sensitive data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Haaken version 1.6 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.