CVE-2026-62018

Summary

The Gunslinger application before 1.12 contains an unauthenticated PHP object injection vulnerability (CWE-502) in its deserialization logic, allowing remote attackers to inject malicious serialized objects and execute arbitrary code without authentication.

Exploitability

Exploitation is straightforward for attackers due to the lack of authentication, network accessibility, and absence of input validation on the vulnerable deserialization endpoint.

Blast radius

Successful exploitation grants full system compromise including confidentiality, integrity, and availability impacts, affecting all users and systems running affected versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Gunslinger version 1.12 or later, which includes a fix for the unauthenticated PHP object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.