CVE-2026-62120

Summary

A critical PHP object injection vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into the Law Office application, potentially leading to remote code execution and full system compromise. This flaw affects versions up to 3.20.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered through web requests, though successful exploitation may depend on specific application configuration or available classes in the codebase.

Blast radius

The impact could be severe across all installations running Law Office 3.20 or earlier, potentially allowing attackers to execute arbitrary code, access sensitive data, and fully compromise affected systems without any user interaction.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.21 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.