CVE-2026-62011

Summary

The Bonbon application before version 1.12 contains an unauthenticated PHP object injection vulnerability (CWE-502) in its deserialization logic, allowing remote attackers to inject malicious serialized objects and potentially achieve arbitrary code execution without authentication.

Exploitability

Exploitation is straightforward for attackers due to the lack of authentication requirements and low attack complexity.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts across the affected application and potentially underlying infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Bonbon version 1.12 or later, which contains a fix for the unauthenticated PHP object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.