CVSS 8.4 (high) · published 2026-11-13
Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Weakness: CWE-502
Source: NVD CVE-2026-59081
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.