Vulnerability record/PUBLISHED/Published Nov 13, 2026 07:29:04 UTC

CVE-2026-59081

Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Base score8.4/ 10

SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorLocalAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredHighPR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityLowSA

CVSS vector stringCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityCERT-PL

Last updatedNov 13, 2026 07:29:04 UTC

PublishedNov 13, 2026 07:29:04 UTC

ReservedJul 2, 2026 08:57:58 UTC

Credits

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
Paweł Zdunek (AFINE Team)