CVE-2026-97248

Summary

The flaw is an unauthenticated PHP Object Injection vulnerability in Booking Activities versions up to 1.18.7.1, allowing attackers to inject arbitrary PHP objects and potentially execute arbitrary code or cause a denial of service.

Exploitability

Exploitation is relatively straightforward as it requires no authentication, but the attacker must have access to the affected endpoint.

Blast radius

If exploited, the vulnerability could lead to full compromise of the affected system, including unauthorized code execution or service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Booking Activities version 1.18.8 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.