CVE-2026-62018

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

Gunslinger versions up to and including 1.11 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Risk Assessment

PHP object injection can lead to code execution, data disclosure, or other serious impacts depending on available classes.

Recommendation

Update Gunslinger to a version later than 1.11 or apply the vendor fix, and restrict access to the application until patched.

Other vulnerabilities in Gunslinger

CVE-2025-69166High
Gunslinger versions up to 1.7 are vulnerable to unauthenticated local file inclusion.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS