Which versions of Quick.CMS are affected by CVE-2026-11860?

Quick.CMS by OpenSolution contains an unsafe deserialization vulnerability in the administrator panel (CVE-2026-11860) that allows attackers positioned to intercept network traffic to execute…

How to fix or mitigate CVE-2026-11860?

24 hours: Inventory all Quick.CMS instances and identify those running versions prior to 6.8; assess whether admin panels are exposed to untrusted networks. 7 days: Upgrade all instances to Quick.CMS version 6.8 or newer and verify HTTPS enforcement on admin panel endpoints. 30 days: Complete deployment of version 6.8 across all systems and implement network segmentation restricting admin access to internal networks and VPN users only.

Quick.CMS CVE-2026-11860

Q: What is the CVSS score of CVE-2026-11860?

CVE-2026-11860 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36703 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 CERT-PL

GHSA-vwj5-2gmw-wjp6

Deserialization RCE Quick Cms

7.5

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

7.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Adjacent network MITM required (AV:A), tampering plus timing makes AC:H, attacker needs no auth (PR:N), admin must visit panel (UI:R), full RCE gives C/I/A:H.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 10:31 vuln.today

DescriptionCVE.org

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.

When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel.

This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.

AnalysisAI

Unsafe PHP deserialization in Quick.CMS by OpenSolution lets an on-path attacker who can tamper with the plaintext HTTP channel inject malicious serialized objects that are deserialized when an administrator opens the admin panel, yielding arbitrary code execution on the server. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:P) reflects that exploitation requires adjacent-network MITM positioning plus an administrator session, and no public exploit identified at time of analysis. CERT-PL reported the issue and OpenSolution shipped a patch for version 6.8 on 14.05.2026 that mitigates the flaw by forcing HTTPS.

Technical ContextAI

Quick.CMS is a PHP-based content management system distributed by OpenSolution (CPE cpe:2.3:a:opensolution:quick.cms). The root cause is CWE-502 (Deserialization of Untrusted Data): the application invokes PHP unserialize() on data delivered through an unauthenticated, plaintext HTTP transport without integrity protection (no signed token, MAC, or class allow-list). PHP's unserialize() instantiates arbitrary classes and automatically invokes magic methods such as __wakeup() and __destruct(); when reachable classes form a usable POP (property-oriented programming) gadget chain, this primitive escalates to arbitrary code execution. Because the trigger lives on the admin path, the dangerous deserialize() call is reached the moment an authenticated administrator loads the panel.

RemediationAI

Apply the vendor-released patch for Quick.CMS 6.8 published on 14.05.2026 (see https://opensolution.org/ and the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-11860/), which mitigates the flaw by forcing the affected channel to HTTPS. Where the patch cannot be applied immediately, force TLS for the entire site (HSTS with includeSubDomains and preload, redirect all HTTP to HTTPS at the web server, and disable plaintext listeners) so that serialized payloads cannot be tampered with in transit - note that this only closes the MITM vector and leaves the underlying unsafe unserialize() call intact, so any future internal path that reaches it would still be exploitable. As additional compensating controls, restrict admin-panel access to a VPN or office IP allow-list (trade-off: breaks remote admin workflows), require administrators to authenticate only from networks you control, and monitor admin sessions for unexpected outbound connections that could indicate gadget-chain execution.