CVE-2026-78531

Summary

A critical PHP object injection vulnerability exists in Jacqueline versions up to 2.22, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely.

Exploitability

Exploitation is relatively straightforward with no authentication required, though it may depend on specific application configuration or data handling patterns that allow the injected objects to be unserialized.

Blast radius

The vulnerability could lead to full remote code execution across all affected installations, potentially compromising entire web servers and applications running Jacqueline.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Jacqueline 2.23 or later to remediate this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.