CVE-2026-78535

Summary

A critical PHP object injection vulnerability exists in Photolia versions 1.0.3 and earlier, allowing unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution, data compromise, or system takeover.

Exploitability

Exploitation is relatively straightforward with no authentication required, though it may depend on the application's configuration and whether specific endpoints are exposed to external access.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data exfiltration, or further lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Photolia version 1.0.4 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.