CVE-2026-66569

Summary

A critical PHP object injection vulnerability exists in Kicker versions up to 2.2.1 that allows unauthenticated attackers to inject arbitrary PHP objects, potentially leading to remote code execution or complete system compromise.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered through a crafted HTTP request, though the attacker needs to understand the target's PHP object structure to create effective payloads.

Blast radius

The vulnerability could affect any Kicker installation running version 2.2.1 or earlier, potentially allowing attackers to execute arbitrary code on the server, access sensitive data, and fully compromise affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Kicker version 2.2.2 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.