CVE-2026-11860

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel. When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel. This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/06/CVE-2026-11860/
https://opensolution.org/

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-15 10:16

Updated : 2026-07-24 19:10

NVD link : CVE-2026-11860

Mitre link : CVE-2026-11860

CVE.ORG link : CVE-2026-11860

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-11860", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11860", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-15T10:46:25.493730Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "OpenSolution", "product": "Quick.CMS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-15T10:16:27.870", "references": [{"url": "https://cert.pl/posts/2026/06/CVE-2026-11860/", "source": "cvd@cert.pl"}, {"url": "https://opensolution.org/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.\n\nWhen successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel.\n\nThis issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable."}, {"lang": "es", "value": "Quick.CMS deserializa datos controlados por el usuario recibidos a trav\u00e9s de HTTP en texto plano sin garantizar la integridad o la autenticidad. Esto permite a los atacantes manipular cargas \u00fatiles serializadas en tr\u00e1nsito e inyectar objetos maliciosos. Debido a que la deserializaci\u00f3n se realiza sin una validaci\u00f3n adecuada o restricciones de clase, las cargas \u00fatiles manipuladas pueden desencadenar m\u00e9todos m\u00e1gicos peligrosos (p. ej., __wakeup() y __destruct()) y aprovechar cadenas de gadgets, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario. La explotaci\u00f3n se activa autom\u00e1ticamente cuando un administrador accede al panel de administraci\u00f3n.\n\nCuando se explota con \u00e9xito, esta vulnerabilidad permite a los atacantes ejecutar c\u00f3digo arbitrario en el servidor a trav\u00e9s de datos serializados manipulados transmitidos a trav\u00e9s de un canal no protegido.\n\nEste problema se mitig\u00f3 limitando la comunicaci\u00f3n a HTTPS en un parche para la versi\u00f3n 6.8 publicado el 14.05.2026; las implementaciones sin este parche siguen siendo vulnerables."}], "lastModified": "2026-07-24T19:10:00.160", "sourceIdentifier": "cvd@cert.pl"}