Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-11860: Quick.CMS allows attackers to execute code via manipulated admin panel access

CVE-2026-11860 · published 4 months ago

Summary

An attacker can manipulate data sent to Quick.CMS's admin panel, allowing them to execute arbitrary code on the server. This can happen if you access the admin panel after receiving a manipulated request over an unsecured internet connection. To protect your server, ensure you're running the latest version of Quick.CMS, specifically version 6.8 or later, which fixes this issue by requiring secure connections.

Original advisory text

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.

When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel.

This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

CWE-502Deserialization of Untrusted Data

Timeline

Published15 Jun 2026

Updated4 Nov 2026

First seen15 Jun 2026

Sources

CVE-2026-11860 · NVD

Track software like this

Free during beta