CVE-2026-62052

PHP Object Injection vulnerability in Tipsy versions up to and including 1.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

An unauthenticated attacker can remotely exploit the vulnerability without logging in, posing a high risk of application compromise. Organizations using the vulnerable version are exposed to compromise.

Update Tipsy to a version later than 1.6 or apply available security patches. Until updated, consider restricting access to the application.