Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.Referenceshttps://www.blesta.com/2026/01/28/security-advisory/
