{"id":"CVE-2026-59081","kind":"vulnerability","aliases":["CVE-2026-59081"],"related":[],"title":"Edito CMS: unsafe JSON deserialization lets cache tampering run server code","description":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS deserializes JSON data from its cache without validating it. An attacker who can modify or inject cache entries could execute code on the server.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edito-cms","other","self-hosted"],"not_affected_if":["cache-not-writable-by-attackers"],"how_to_check":"- Confirm the installed Edito CMS version and compare it with the fixed release `5.10.2607`\n- Check whether cache entries are writable by anyone other than the application, using the cache location from the Edito configuration (unknown if the sources do not say)","fix":"- Upgrade Edito CMS to `5.10.2607`\n- Hotfixes for version `5.8` have also been released (exact hotfix version unknown)","status":"open","published_at":"2026-11-13T08:17:18+00:00","first_seen_at":"2026-11-13T08:44:25+00:00","triaged_at":"2026-11-13T08:45:20+00:00","updated_at":"2026-11-13T08:45:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T08:45:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Edito CMS to `5.10.2607`\n- Hotfixes for version `5.8` have also been released (exact hotfix version unknown)","reach":"unknown","title":"Edito CMS: unsafe JSON deserialization lets cache tampering run server code","impact":"high","summary":"Edito CMS deserializes JSON data from its cache without validating it. An attacker who can modify or inject cache entries could execute code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Code runs on the server after cache entries are tampered with","analyst_note":"Check the NVD entry and Edito vendor advisory for the affected version range, the cache attack path, and whether the 5.8 hotfix version is named.","how_to_check":"- Confirm the installed Edito CMS version and compare it with the fixed release `5.10.2607`\n- Check whether cache entries are writable by anyone other than the application, using the cache location from the Edito configuration (unknown if the sources do not say)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cache-not-writable-by-attackers"],"who_is_affected":"Teams running Edito CMS on their own servers. The sources state that a user, even an administrator, cannot exploit this through normal application features; the risk requires an attacker able to modify or inject cache entries. Sites where the cache is only writable by the application itself are less exposed. Whether the cache is reachable from outside is unknown from the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4546,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59081':14A,17A '5.10.2607':96C '5.8':101C 'administr':63C 'also':103C 'applic':70C 'attack':37B,75C 'cach':7A,32B,43B,79C 'cannot':64C 'cms':2A,20B,26B,52C 'code':11A,47B,86C 'could':45B,77C,84C 'cve':12A,15A 'data':29B,55C 'deseri':5A,27B,53C 'edito':1A,19B,25B,51C 'edito-cm':18B 'entri':44B,80C 'even':61C 'execut':46B,85C 'exploit':65C 'fix':93C 'function':73C 'host':24B 'hotfix':97C 'inject':42B,82C 'issu':91C 'json':4A,28B,54C 'let':6A 'modifi':40B,78C 'normal':72C 'older':99C 'releas':105C 'run':9A 'self':23B 'self-host':22B 'server':10A,50B,89C 'tamper':8A 'unsaf':3A 'user':60C 'valid':34B,58C 'version':95C,100C 'vulner':67C 'without':33B,56C","nicknames":[],"mitigations":[],"who_affected":"Teams running Edito CMS on their own servers. The sources state that a user, even an administrator, cannot exploit this through normal application features; the risk requires an attacker able to modify or inject cache entries. Sites where the cache is only writable by the application itself are less exposed. Whether the cache is reachable from outside is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["editocms","high","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59081':14A,17A 'cach':7A 'cms':2A 'code':11A 'cve':12A,15A 'deseri':5A 'edito':1A 'json':4A 'let':6A 'run':9A 'server':10A 'tamper':8A 'unsaf':3A","search_b":"'attack':37B 'cach':32B,43B 'cms':20B,26B 'code':47B 'could':45B 'data':29B 'deseri':27B 'edito':19B,25B 'edito-cm':18B 'entri':44B 'execut':46B 'host':24B 'inject':42B 'json':28B 'modifi':40B 'self':23B 'self-host':22B 'server':50B 'valid':34B 'without':33B","search_c":"'5.10.2607':96C '5.8':101C 'administr':63C 'also':103C 'applic':70C 'attack':75C 'cach':79C 'cannot':64C 'cms':52C 'code':86C 'could':77C,84C 'data':55C 'deseri':53C 'edito':51C 'entri':80C 'even':61C 'execut':85C 'exploit':65C 'fix':93C 'function':73C 'hotfix':97C 'inject':82C 'issu':91C 'json':54C 'modifi':78C 'normal':72C 'older':99C 'releas':105C 'server':89C 'user':60C 'valid':58C 'version':95C,100C 'vulner':67C 'without':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59081","severity":null,"published_at":"2026-11-13T08:17:18+00:00","modified_at":"2026-11-13T08:17:18+00:00","first_seen_at":"2026-11-13T08:44:25+00:00","fetched_at":"2026-11-13T08:44:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}