CVE-2026-76834: b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in paramcheckserializedarray() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/callplugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
b2evolution CMSto a version that resolves this vulnerability.Fixed in 6.7.8 through 7.2.5 - Upgrade
Upgrade
b2evolution CMSto a version that resolves this vulnerability.Fixed in 7.2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running b2evolution CMS versions 6.7.8 through 7.2.5 are affected. The vulnerable endpoint can be reached remotely, and exploitation does not require authentication or user interaction.
What does an attacker need to exploit it?
An attacker needs to send a crafted POST request containing serialized PHP objects to htsrv/call_plugin.php. Successful impact beyond object instantiation depends on suitable PHP object-population gadget chains being available.
Are default deployments affected?
The available information identifies the affected versions and reachable endpoint, but does not state whether any particular default configuration prevents access to it. Systems should treat exposed installations in the listed version range as potentially vulnerable.
How can I assess whether an installation is affected?
Check whether the installation is running a version from 6.7.8 through 7.2.5 and whether htsrv/call_plugin.php is reachable for POST requests. Review request logs for suspicious POST data directed at that path, especially serialized payloads using negative integer array keys.