Live › vulnerability › CVE-2026-62009
Filmax versions up to 1.1.11 unserialize untrusted input, so an unauthenticated visitor can inject a PHP object. The sources say this is critical with a CVSS score of 9.8, which suggests code execution or full site takeover, but they give no further detail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Filmax theme at version 1.1.11 or older are exposed, and the attack needs no login. Sites on other themes or on a later Filmax release are not affected. The sources do not say which request paths or settings trigger the flaw.
No product ranges from the sources yet.
1.1.11; the fixed version is not stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.