Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-76834b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
High 8.1
In plain English
A high-severity unsafe deserialization in b2evolution CMS from b2evolution. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| b2evolution | b2evolution CMS | 6.7.8 – through 7.2.5 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gist.github.com/axg11/3e29501c33f6e1e05ac2a00107afd64e technical-description
- https://github.com/b2evolution/b2evolution/blob/7.2.5/inc/_core/_param.funcs.php#L2860 technical-description
- https://github.com/b2evolution/b2evolution/blob/7.2.5/htsrv/call_plugin.php#L49 technical-description
- Incomplete fix for CVE-2016-8901 (1 of 2) patch
- Incomplete fix for CVE-2016-8901 (2 of 2) patch
- Introduces the flawed regular expression, first released in 6.7.8 technical-description, patch
- b2evolution CMS end-of-life announcement vendor-advisory
- https://github.com/b2evolution/b2evolution product
- VulnCheck Advisory: b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key third-party-advisory