Deserialization in Una Cms

CVE-2025-66571

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

Vulnerability class: Insecure Deserialization

EPSS: 0.005 (41.9th percentile) — read the EPSS interpretation.

Affected products

Unknown Una Cms — versions 9.0.0-RC1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

ExploitDB-52139 (exploit)
UNA CMS Homepage (product)
UNA CMS GitHub Repository (product)
Karma Security Advisory (vdb-entry)
disclosure@vulncheck.com (third-party-advisory)