CVE-2026-59081: Deserialization of untrusted data in Edito CMS
Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.2607
Event History
Frequently Asked Questions
Who can exploit this issue?
It is not exploitable by a user, including an administrator, through normal application functionality. Exploitation requires an attacker to be able to modify or inject cache entries.
What is the impact if an attacker can manipulate cache entries?
An attacker able to modify or inject cache entries could execute code on the server. The stated severity is high, with impacts to confidentiality, integrity, and availability.
Which fixes are available?
The issue was fixed in Edito CMS version 5.10.2607. Hotfixes have also been released for older 5.8 versions.