CVE-2026-62077

Summary

Avala versions 1.1.4 and earlier contain an unauthenticated PHP object injection vulnerability that allows remote attackers to execute arbitrary code with high impact. This flaw occurs when user-supplied data is serialized and then unserialized without proper validation, leading to potential remote code execution.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request to the vulnerable endpoint, making it highly suitable for automated attacks.

Blast radius

The vulnerability could affect any installation running Avala 1.1.4 or earlier, potentially allowing attackers to execute arbitrary code on the server, leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Avala version 1.1.5 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.