---
id: "CVE-2026-59081"
page: "https://infrastack.ai/live/CVE-2026-59081"
kind: "vulnerability"
aliases: ["CVE-2026-59081"]
title: "Edito CMS: unsafe JSON deserialization lets cache tampering run server code"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["edito-cms", "other", "self-hosted"]
not_affected_if: ["cache-not-writable-by-attackers"]
published_at: "2026-11-13T08:17:18+00:00"
first_seen_at: "2026-11-13T08:44:25+00:00"
updated_at: "2026-11-13T08:45:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59081", "first_seen_at": "2026-11-13T08:44:25+00:00"}]
exploit_sources: []
---

# Edito CMS: unsafe JSON deserialization lets cache tampering run server code

Link for people: https://infrastack.ai/live/CVE-2026-59081 (this .md is for agents)

Edito CMS deserializes JSON data from its cache without validating it. An attacker who can modify or inject cache entries could execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Edito CMS version and compare it with the fixed release `5.10.2607`
- Check whether cache entries are writable by anyone other than the application, using the cache location from the Edito configuration (unknown if the sources do not say)

## Fix

- Upgrade Edito CMS to `5.10.2607`
- Hotfixes for version `5.8` have also been released (exact hotfix version unknown)

## Timeline

- 2026-11-13T08:44:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59081

## From the sources

Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.




This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_