CVE-2026-62131

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Risk Assessment

PHP object injection can lead to code execution, data disclosure, or other serious impacts depending on available classes.

Recommendation

Update Zoho Flow to a version later than 2.14.5 or apply the vendor fix, and restrict access to the application until patched.

Other vulnerabilities in Zoho Flow

CVE-2025-59568Medium
The Zoho Flow WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.14.1. This may allow an attacker to force unintended actions on behalf of an authenticated user.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS