PHP Deserialization Vulnerability in openITCOCKPIT Monitoring Tool

CVE-2026-24892

What is CVE-2026-24892?

openITCOCKPIT Community Edition versions 5.3.1 and earlier have a latent PHP object injection vulnerability due to an unsafe deserialization pattern in handling changelog entries. Serialized changelog data, influenced by external inputs, is processed without adequately restricting allowed classes for deserialization. Although no direct paths for PHP object introduction currently exist, future code modifications may inadvertently expose this vulnerability, allowing potential remote code execution and significant security risks.

References