CVE-2026-62008

Summary

The vulnerability is an unauthenticated PHP Object Injection (CWE-502) in Orpheus versions <= 1.8, allowing attackers to deserialize arbitrary PHP objects without authentication, leading to remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication and low complexity, requiring only a crafted serialized payload sent to a vulnerable endpoint.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, unauthorized data access, and service disruption across any environment running the affected Orpheus version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Orpheus version 1.9 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.