CVE-2026-54860

Summary

The Ozisti application before version 1.1.11 contains an unauthenticated PHP object injection vulnerability (CWE-502) in its deserialization logic, allowing remote attackers to inject malicious serialized objects that can lead to arbitrary code execution, data exfiltration, or system compromise.

Exploitability

Exploitation is straightforward for remote attackers due to lack of authentication requirements and low complexity; no user interaction or prior access is needed.

Blast radius

Successful exploitation could result in full system compromise including confidentiality, integrity, and availability impacts across any environment hosting the vulnerable Ozisti version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ozisti version 1.1.11 or later, which contains a fix for the unauthenticated PHP object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.