What is the CVSS score of CVE-2026-22248?

CVE-2026-22248 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22248?

A critical deserialization vulnerability (CVE-2026-22248) affects our software licensing and audit tracking systems in versions 11.0.0 through 11.0.5.

How to fix or mitigate CVE-2026-22248?

Within 24 hours: Identify all systems running affected versions (11.0.0-11.0.5) and isolate them from untrusted networks; document inventory and current system state. Within 7 days: Implement network segmentation to restrict access to these systems; disable remote access where operationally feasible; increase monitoring for suspicious deserialization activities. Within 30 days: Develop and test upgrade plan to versions 11.0.6 or later; coordinate with vendor for patch availability timeline and deploy immediately upon release; validate all licensing data integrity post-patch.

PHP CVE-2026-22248

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-11 security-advisories@github.com

PHP Deserialization

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 16:16 nvd

HIGH 8.0

DescriptionGitHub Advisory

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.

AnalysisAI

licenses tracking and software auditing. From 11.0.0 to versions up to 11.0.5 is affected by deserialization of untrusted data (CVSS 8.0).

Technical ContextAI

This vulnerability (CWE-502: Deserialization of Untrusted Data) affects licenses tracking and software auditing. From 11.0.0 to. GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.