Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities
• Software Link:
• Affected Versions:
All versions from 3.0.0 to 5.13.1.
• Vulnerabilities Description:
The vulnerabilities exist because user input passed through the “vars” and “order_info” POST parameters when dispatching the /app/controllers/admin_clients.php script, and through the “$group_name” POST parameter when dispatching the /app/controllers/admin_company_groups.php script, is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by malicious administrator users to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code (RCE).
• Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-25615.php
• Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
• Disclosure Timeline:
[19/01/2026] – Vendor notified
[20/01/2026] – Vendor response stating: “this issue was previously identified during an internal security review”
[22/01/2026] – CVE identifier requested
[28/01/2026] – Version 5.13.2 released
[31/01/2026] – Version 5.13.3 released to address regressions introduced in 5.13.2
[03/02/2026] – CVE identifier assigned
[04/02/2026] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has assigned the name CVE-2026-25615 to these vulnerabilities.
• Credits:
Vulnerabilities discovered by Egidio Romano.