PT-2026-49188 · Quick.Cms · Quick.Cms

Arkadiusz Marta · CVE-2026-11860 · Published 2026-06-15 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Quick.CMS versions prior to 6.8

Description Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods, such as wakeup() and destruct(), and leverage gadget chains to achieve arbitrary code execution. Exploitation occurs automatically when an administrator accesses the admin panel.

Recommendations Update to version 6.8 or later to ensure communication is limited to HTTPS.

Fix

RCE

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2026-11860

Affected Products

Quick.Cms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-11860 · Security Note
• https://opensolution.org · Note
• https://twitter.com/CVEnew/status/2066583824813723841 · Twitter Post
• https://twitter.com/infoflowcloud/status/2066584355552526680 · Twitter Post
• https://twitter.com/f1tym1/status/2066458127436837175 · Twitter Post
• https://cert.pl/posts/2026/06/CVE-2026-11860 · Note
• https://t.me/CVEtracker/56848 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2066475011284598923 · Twitter Post