{"affected":[{"defaultStatus":"unaffected","product":"Edito CMS","source":"CNA: CERT-PL","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-59081","cwes":["CWE-502"],"description":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: CERT-PL","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0"}],"modifiedAt":1794554944031,"publishedAt":1794554944031,"references":[{"source":"CNA: CERT-PL","tags":[],"url":"https://cert.pl/posts/2026/07/CVE-2026-59081"},{"source":"CNA: CERT-PL","tags":[],"url":"https://www.edito.pl/"}],"remediation":[],"revision":"00745da9f505dc5611fc118ea49b5b9dcee4eac27eb9b34d5e45d09114406ea2","sources":[{"modifiedAt":1794554944031,"name":"CNA: CERT-PL","retrievedAt":1794557325756,"url":"https://www.cve.org/CVERecord?id=CVE-2026-59081"}],"ssvc":null,"status":"published","title":"Deserialization of untrusted data in Edito CMS","updatedAt":1794557325756}