CVE-2026-62001

Summary

Unauthenticated PHP Object Injection in Marcell versions <= 1.2.14 allows attackers to inject malicious serialized PHP objects via unsanitized user input, leading to arbitrary code execution, data exfiltration, or system compromise.

Exploitability

Exploitation is straightforward for remote attackers due to lack of authentication and direct injection point; no user interaction or prior access required.

Blast radius

Full system compromise is likely, enabling full confidentiality, integrity, and availability impact including remote code execution and server takeover.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Marcell version 1.2.15 or later, which patches the PHP object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.