CVE-2026-11860— Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
Possible ATT&CK Techniques 3AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OpenSolution | Quick.CMS | ≤ 6.8 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
Source: NVD (National Vulnerability Database)
Vulnerability Description
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel. When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel. This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenSolution Quick.CMS 反序列化漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSolution quick.cms是OpenSolution组织开源的一个内容管理系统。 OpenSolution Quick.CMS 6.8之前版本存在安全漏洞，该漏洞源于在HTTP上传输反序列化数据时未验证数据完整性和真实性，可能导致攻击者在传输过程中篡改序列化有效载荷并注入恶意对象。由于反序列化没有正确验证或类限制，特制有效载荷可能触发危险魔法方法并结合小工具链，导致远程代码执行。当管理员访问管理面板时，利用会自动触发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenSolution | Quick.CMS | 0 ~ 6.8 | - |
II. Public POCs for CVE-2026-11860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11860
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-11860 (1)
- 🔗 Podatność w oprogramowaniu Quick.CMS | CERT Polskathird-party-advisory
Vendor Pages for CVE-2026-11860 (1)
IV. Related Vulnerabilities
Same product: Quick.CMS
- CVE-2021-47981
Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form - CVE-2024-58308
Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin - CVE-2025-54174
Cross-Site Request Forgery in QuickCMS - CVE-2025-54172
Stored Cross-Site Scripting in QuickCMS - CVE-2024-11992
Path traversal vulnerability in Quick.CMS
Same weakness: CWE-502
- CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted - CVE-2026-43825
Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserial - CVE-2026-43866
Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix b - CVE-2026-43867
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecyc - CVE-2026-46590
Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets
V. Comments for CVE-2026-11860
No comments yet