CVE-2026-62054

Summary

A critical PHP object injection vulnerability exists in Yacht Rental versions up to 2.6, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely.

Exploitability

Exploitation is straightforward with no authentication required, though it may need a specific request pattern to trigger the deserialization process.

Blast radius

The vulnerability could lead to complete system compromise with remote code execution, potentially affecting all users and data in the yacht rental application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.7 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.