CVE-2026-40756

HighCVSS 8.1

Published: 17/06/2026(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Summary

Zoya versions up to 1.4 contain a vulnerability to unauthenticated PHP object injection, which may lead to unauthorized access to the system.

Organizations using vulnerable versions of Zoya may be exposed to attacks that could lead to takeover of the application.

It is recommended to upgrade to the latest version of Zoya to mitigate this vulnerability.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.