CVE-2026-66568

Summary

A critical PHP object injection vulnerability allows unauthenticated attackers to inject malicious PHP objects into the application, potentially leading to remote code execution and full system compromise. This affects Original versions up to 1.9.0.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request, though it may require knowledge of the specific object structure to achieve full RCE.

Blast radius

If exploited, this vulnerability could lead to complete system compromise with potential for data exfiltration, persistence mechanisms, and lateral movement across the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Original version 1.9.1 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.