Live › vulnerability › CVE-2026-54857
Quirky versions 1.23 and older accept untrusted input that gets unserialized as a PHP object. An unauthenticated attacker can use this to inject objects, which can lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running Quirky version 1.23 or older are exposed. The sources do not say which endpoint or setting is the entry point, so whether a site without a special configuration is reachable is unknown.
No product ranges from the sources yet.
1.23; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54857")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.