Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-11860— Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS

Quick assessment

Affected
OpenSolution Quick.CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenSolution quick.cms是OpenSolution组织开源的一个内容管理系统。 OpenSolution Quick.CMS 6.8之前版本存在安全漏洞，该漏洞源于在HTTP上传输反序列化数据时未验证数据完整性和真实性，可能导致攻击者在传输过程中篡改序列化有效载荷并注入恶意对象。由于反序列化没有正确验证或类限制，特制有效载荷可能触发危险魔法方法并结合小工具链，导致远程代码执行。当管理员访问管理面板时，利用会自动触发。

AI Predicted 9.8 Difficulty: Easy EPSS 0.24% · P13

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenSolution Quick.CMS ≤ 6.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-11860

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
Source: CVE Program / CVE List V5
Vulnerability Description
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel. When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel. This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSolution Quick.CMS 反序列化漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSolution quick.cms是OpenSolution组织开源的一个内容管理系统。 OpenSolution Quick.CMS 6.8之前版本存在安全漏洞，该漏洞源于在HTTP上传输反序列化数据时未验证数据完整性和真实性，可能导致攻击者在传输过程中篡改序列化有效载荷并注入恶意对象。由于反序列化没有正确验证或类限制，特制有效载荷可能触发危险魔法方法并结合小工具链，导致远程代码执行。当管理员访问管理面板时，利用会自动触发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenSolution Quick.CMS 0 ~ 6.8 -

II. Public POCs for CVE-2026-11860

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-11860

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-11860 (1)

Vendor Pages for CVE-2026-11860 (1)

IV. Related Vulnerabilities

Same product: Quick.CMS
Same vendor: OpenSolution
Same weakness: CWE-502

V. Comments for CVE-2026-11860

No comments yet

Leave a comment