Live › vulnerability › CVE-2026-54858
Printy versions up to 1.13.0 accept attacker-supplied serialized PHP data without authentication. A remote attacker can use PHP object injection to potentially run code or reach sensitive data on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Printy plugin at version 1.13.0 or older are exposed. The sources do not say which endpoint is involved or whether any non-default setting is required, and do not say whether a fixed release exists.
No product ranges from the sources yet.
1.13.0 and older are listed as affected.1.13.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54858")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.