Which versions of BeWelcome Rox are affected by CVE-2025-34292?

Rox, the PHP platform powering BeWelcome's hospitality exchange network, contains a critical remote code execution vulnerability in form and cookie handling that could allow attackers to execute…

How to fix or mitigate CVE-2025-34292?

Within 24 hours: Immediately disable or restrict processing of the `formkit_memory_recovery` POST parameter and `bwRemember` cookie through WAF rules or configuration changes; issue a security advisory to all BeWelcome members and recommend password resets as a precautionary measure. Within 7 days: Apply the security fix from commit c60bf04 (dated 2025-06-16) to a staging environment, conduct comprehensive security testing, and review server logs for exploitation patterns in the vulnerable code paths. Within 30 days: Deploy the patched version to all production systems, implement persistent monitoring for exploitation attempts, and conduct a full audit of unserialize() usage throughout the Rox codebase.

BeWelcome Rox CVE-2025-34292

Q: What is the CVSS score of CVE-2025-34292?

CVE-2025-34292 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-27 disclosure@vulncheck.com

PHP RCE Deserialization

9.4

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable unserialize() sink with low complexity and no interaction, but the CVSS vector's PR:L implies a low-privilege foothold; deserialization-to-RCE yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 23:32 vuln.today

Analysis Generated

Jul 14, 2026 - 23:32 vuln.today

CVE Published

Oct 27, 2025 - 15:15 cve.org

CRITICAL 9.4

DescriptionCVE.org

Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter formkit_memory_recovery in \\RoxPostHandler::getCallbackAction and the 'memory cookie' read by \\RoxModelBase::getMemoryCookie (bwRemember). (1) If present, formkit_memory_recovery is processed and passed to unserialize(), and (2) restore-from-memory functionality calls unserialize() on the bwRemember cookie value. Gadget chains present in Rox and bundled libraries enable exploitation of object injection to write arbitrary files or achieve remote code execution. Successful exploitation can lead to full site compromise. This vulnerability was remediated with commit c60bf04 (2025-06-16).

AnalysisAI

Remote code execution in Rox, the PHP platform powering the BeWelcome hospitality-exchange community, arises from unsafe unserialize() calls on attacker-controllable input: the POST parameter formkit_memory_recovery handled by RoxPostHandler::getCallbackAction and the bwRemember 'memory cookie' read by RoxModelBase::getMemoryCookie. Because usable PHP gadget chains ship in Rox and its bundled libraries, an attacker with low-level access can trigger PHP object injection to write arbitrary files or execute code, resulting in full site compromise. The issue carries a CVSS 4.0 base score of 9.4 and was fixed in commit c60bf04 (2025-06-16); no public exploit identified at time of analysis, though a referenced technical gist may contain exploitation detail.

Technical ContextAI

The vulnerability is a classic CWE-502 Deserialization of Untrusted Data flaw in a PHP web application. PHP's unserialize() reconstructs arbitrary object graphs from a serialized string; if an application feeds untrusted bytes to it, an attacker can instantiate objects of any class currently loaded and control their properties. When such objects define 'magic methods' (__wakeup, __destruct, __toString, etc.) or when combined into a POP (Property-Oriented Programming) gadget chain across the application and its bundled libraries, deserialization alone can drive file writes, code inclusion, or command execution - this is PHP Object Injection. In Rox, two sinks receive untrusted data: the restore-from-memory ('remember me') feature deserializes the bwRemember cookie, and getCallbackAction deserializes the formkit_memory_recovery POST field (after stripslashes/htmlspecialchars_decode). The disclosure notes that suitable gadget chains already exist within Rox and its dependencies, converting object injection into arbitrary file write / RCE. No CPE strings were supplied in the input, so exact platform identifiers are unavailable; the affected component is identified from the source repository (github.com/BeWelcome/rox) and the patch diff to tools/services/roxposthandler.class.php.

Affected ProductsAI

The affected product is Rox, the open-source PHP application that runs the BeWelcome hospitality-exchange website (repository: https://github.com/BeWelcome/rox). No CPE identifiers were provided and the input specifies no version range; affected versions are those prior to fix commit c60bf04 dated 2025-06-16 (https://github.com/BeWelcome/rox/commit/c60bf04). The vulnerable code resides in tools/services/roxposthandler.class.php (RoxPostHandler::getCallbackAction) and the memory-cookie handling in RoxModelBase::getMemoryCookie. Vendor/researcher advisory: https://www.vulncheck.com/advisories/rox-php-object-injection-rce, with additional technical notes at https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply Rox commit c60bf04 (2025-06-16), which removes the unserialize() of formkit_memory_recovery (the diff sets $mem_from_recovery = false) and hardens the callback handler; pull the current main branch of https://github.com/BeWelcome/rox if no tagged release is used. If you cannot patch immediately, the effective compensating controls are targeted: stop passing the formkit_memory_recovery POST parameter and the bwRemember memory cookie into unserialize() by disabling the restore-from-memory ('remember me') feature, or replace unserialize() with a safe encoding (JSON) or the allowed_classes => false option so no objects can be instantiated (trade-off: existing remember-me sessions break and users must re-authenticate). As a network-layer stopgap, use a WAF/reverse-proxy rule to reject requests carrying a formkit_memory_recovery field or a bwRemember cookie whose value contains PHP-serialized object markers (e.g. patterns like O: / a:), accepting the risk of false positives and that serialization can be obfuscated. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/rox-php-object-injection-rce) and the mcdruid gist for specifics before deploying filters.