CVE-2026-62050

Summary

A PHP object injection vulnerability in Splendour versions up to 1.23 allows unauthenticated attackers to inject arbitrary PHP objects, leading to potential remote code execution, data compromise, and system takeover.

Exploitability

Exploitation is relatively straightforward with no authentication required, though it may need a specific request pattern or parameter manipulation to trigger the deserialization process.

Blast radius

The vulnerability could affect any installation running Splendour 1.23 or earlier, potentially allowing attackers to execute arbitrary code on the server, access sensitive data, and fully compromise affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.24 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.