What is the CVSS score of CVE-2026-25359?

CVE-2026-25359 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pendulum are affected by CVE-2026-25359?

Pendulum PHP datetime library versions below 3.1.5 contain a deserialization vulnerability that allows attackers to inject malicious objects and execute arbitrary code if exploitable gadget chains…. A patch is available.

How to fix or mitigate CVE-2026-25359?

Within 24 hours: Inventory all systems and applications using Pendulum library and identify current versions via composer.lock or package managers. Within 7 days: Update Pendulum to version 3.1.5 or later across all development, staging, and production environments; test in staging before production deployment. Within 30 days: Conduct code review of applications using Pendulum to identify data deserialization points and validate that untrusted data sources are restricted or sanitized.

Pendulum CVE-2026-25359

EUVD-2026-15681 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-w7gm-q7h5-8h8w

Deserialization Pendulum

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:15 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.1.5

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15681

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Pendulum (a PHP datetime library) versions prior to 3.1.5, allowing attackers to perform object injection attacks. The vulnerability affects the rascals Pendulum library through unvalidated deserialization of user-supplied data. An attacker can exploit this to instantiate arbitrary PHP objects, potentially leading to remote code execution or other malicious outcomes depending on the application's gadget chain availability.

Technical ContextAI

Pendulum is a popular PHP datetime manipulation library (cpe:2.3:a:rascals:pendulum:*:*:*:*:*:*:*:*) that provides enhanced date/time handling functionality. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical weakness where the application deserializes data from an untrusted source without proper validation or integrity checks. In PHP, this typically involves the unserialize() function or similar mechanisms that reconstruct PHP objects from serialized strings. When an attacker controls serialized input, they can craft malicious object graphs that exploit magic methods (__wakeup, __destruct, __toString, etc.) or existing gadget chains within the application to achieve arbitrary code execution or information disclosure.

RemediationAI

Immediately upgrade Pendulum to version 3.1.5 or later to patch the deserialization vulnerability. Applications using Pendulum as a dependency should update via composer (run 'composer update rascals/pendulum') or equivalent package manager. If immediate patching is not feasible, implement strict input validation and whitelisting for any data that flows into deserialization operations; consider replacing unserialize() calls with safer alternatives like json_decode() where applicable. WordPress installations using the Pendulum theme should update to version 3.1.5 or later via the WordPress admin dashboard. For defense-in-depth, disable PHP's auto_prepend_file and auto_append_file directives if not required, and restrict file upload capabilities to prevent gadget chain exploitation. See Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/pendulum/vulnerability/wordpress-pendulum-theme-3-1-5-php-object-injection-vulnerability for additional context.