Description

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T12:16:35.570Z",
  "pubdate": "2026-08-20T12:16:35.570Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in Flatastic versions <= 2.0. This security flaw enables remote, unauthenticated attackers to manipulate serialized data passed into the application, potentially leading to severe security consequences.\nThe vulnerability arises from insecure deserialization practices within the affected product. If exploitable gadget chains are present within the application's codebase or included third-party libraries, an attacker can leverage this flaw to achieve arbitrary code execution, unauthorized data access, or denial of service conditions.\nThe risk implication is critical, as exploitation requires no prior authentication, user interaction, or elevated privileges, lowering the barrier to entry for malicious actors targeting exposed instances of Flatastic <= 2.0.\nDefenders must identify vulnerable deployments and apply immediate vendor-supplied patches or compensating controls to mitigate the risk of object injection attacks.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe processing of user-supplied input through PHP unserialization functions without proper validation or sanitization. In Flatastic <= 2.0, untrusted data exposed via HTTP requests is passed directly into insecure deserialization routines.\nPHP Object Injection occurs when malicious serialized strings are supplied to the unserialize() function in PHP. Because serialization preserves object states and associated class definitions, an attacker can inject custom serialized objects into the application scope.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious serialized payload containing specific property values designed to interact with available classes within the application runtime environment. Second, the attacker transmits this payload via the network to the vulnerable component in Flatastic <= 2.0.\nUpon receipt, the application processes and deserializes the payload. If the application or its included dependencies contain classes with magic methods such as __wakeup() or __destruct() that perform insecure operations on object properties, the execution flow can be hijacked.\nThe vulnerable component involves the backend logic handling parameter ingestion and deserialization within Flatastic <= 2.0. The attack vector is fully network-exposed over HTTP or HTTPS protocols, requiring zero authentication and zero privileges.\nDepending on the availability of suitable gadget chains within the application context, post-exploitation impact can range from arbitrary file read and write operations to Remote Code Execution (RCE) on the underlying server hosting the vulnerable Flatastic installation."
}