CVE-2026-11860: Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS

Synopsis

Insecure deserialization in Quick.CMS (versions up to and including 6.8) allows an attacker on the same network segment to tamper with serialized PHP objects transmitted over plaintext HTTP. Because deserialization runs without class restrictions or integrity checks, a crafted payload can trigger PHP magic methods such as __wakeup() and __destruct() and chain them into arbitrary code execution on the server. Exploitation occurs automatically when an administrator opens the admin panel, requiring no further action from the attacker beyond positioning a malicious payload in transit. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is formally published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as a LAN or VPN in order to intercept and tamper with plaintext HTTP traffic between the administrator's browser and the Quick.CMS server.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to manipulate traffic in transit before the server deserializes it.

• Victim interactionRequired

  An administrator must open the Quick.CMS admin panel, which automatically triggers deserialization of the tampered payload without any further interaction required.

• Attack complexityDetail

  Additional preconditions apply beyond network positioning: the attacker must successfully construct a working PHP gadget chain suited to the target environment, and the exploit window depends on an administrator actively initiating a session.

Blast Radius

• Executes arbitrary operating system commands on the server under the web process user, giving the attacker full control over the application runtime.
• Reads any file accessible to the web server process, including database credentials, session tokens, and application configuration secrets.
• Writes or overwrites files on the server, enabling backdoor installation or defacement of served content.
• Crashes or hangs the web server process, taking the Quick.CMS site offline for legitimate users.