CVE-2026-59081 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS deserializes JSON data from its cache without validating it. An attacker who can modify or inject cache entries could execute code on the server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Edito CMS on their own servers. The sources state that a user, even an administrator, cannot exploit this through normal application features; the risk requires an attacker able to modify or inject cache entries. Sites where the cache is only writable by the application itself are less exposed. Whether the cache is reachable from outside is unknown from the sources.
Not affected if cache-not-writable-by-attackers
Who cares edito-cms, self-hosted
5.10.26075.10.26075.8 have also been released (exact hotfix version unknown)Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.