Vulnerability · Published Oct 27, 2025 · Assigned by VulnCheck
CVE-2025-34292BeWelcome/Rox PHP Object Injection RCE
Critical 9.4
In plain English
A critical-severity unsafe deserialization in Rox from BeWelcome. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter `formkit_memory_recovery` in \\RoxPostHandler::getCallbackAction and the 'memory cookie' read by \\RoxModelBase::getMemoryCookie (bwRemember). (1) If present, `formkit_memory_recovery` is processed and passed to unserialize(), and (2) restore-from-memory functionality calls unserialize() on the bwRemember cookie value. Gadget chains present in Rox and bundled libraries enable exploitation of object injection to write arbitrary files or achieve remote code execution. Successful exploitation can lead to full site compromise. This vulnerability was remediated with commit c60bf04 (2025-06-16).
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/BeWelcome/rox product
- https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398 technical-description, exploit
- https://github.com/BeWelcome/rox/commit/c60bf04 patch
- https://www.vulncheck.com/advisories/rox-php-object-injection-rce third-party-advisory