Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103831— Insecure deserialization in the TrueLayer Magento 2 plugin

Quick assessment

Affected
TrueLayer TrueLayer Magento 2 Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CVE-2026-103831：TrueLayer Magento 2 插件中的 Psr16CacheAdapter 组件存在不安全的反序列化漏洞。该漏洞源于在从缓存中检索数据时，直接使用了 PHP 原生的 函数，且未对允许反序列化的类进行任何限制。如果攻击者已经能够将篡改后的数据写入 Magento 所使用的缓存后端（例如 Redis 或 Memcached），则可以注入特制的 PHP 对象并触发其反序列化，进而利用应用程序环境中可用的“gadget 链”实现任意代码执行。因此，成功利用此漏洞的前提条件是攻击者具

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103831

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insecure deserialization in the TrueLayer Magento 2 plugin
Source: CVE Program / CVE List V5
Vulnerability Description
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TrueLayer TrueLayer Magento 2 Plugin versions 2.4.0 through 2.4.2. -

II. Public POCs for CVE-2026-103831

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103831

请登录查看更多情报信息。

Other References for CVE-2026-103831 (1)

IV. Related Vulnerabilities

Same vendor: TrueLayer
Same weakness: CWE-502

V. Comments for CVE-2026-103831

No comments yet

Leave a comment