{"id":"EM-20261113-G1BX","url":"https://cyber.eventmonitor.net/incident/EM-20261113-G1BX/edito-cms-vulnerability-cve-2026-59081/","type":"cve","title":"Edito CMS Vulnerability (CVE-2026-59081)","subtitle":"CVE-2026-59081","subject":"CVE-2026-59081","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-13T08:17:18.353Z","firstSignal":"2026-11-13T07:29:04.000Z","lastSignal":"2026-11-13T10:55:00.000Z","updated":"2026-11-13T08:33:15.246Z","revision":1,"life":[{"status":"Born","at":"2026-11-13T08:17:18.353Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-13T08:17:18.353Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-13T07:29:04.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-13T08:17:18.353Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261113-G1BX created."},{"at":"2026-11-13T10:55:00.000Z","what":"Source joined: C17 CERT Polska"}],"stages":[{"name":"Disclosed","at":"2026-11-13T08:17:18.353Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-13T08:17:18.353Z","detail":"CVSS 8.4"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-13T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-13T07:29:04.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":3,"title":"EUVD-2026-124883 / CVE-2026-59081 (score 8.4)","text":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124883"},{"at":"2026-11-13T08:17:18.353Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-59081 (CVSS 8.4)","text":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59081"},{"at":"2026-11-13T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in Edito CMS software","text":"CERT Polska has received a report about 8 vulnerabilities (from CVE-2026-59074 to CVE-2026-59081) found in Edito CMS software.","url":"https://cert.pl/en/posts/2026/11/CVE-2026-59074/"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-13T08:17:18.353","score":8.4,"severity":"HIGH","desc":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in…","product":"","seen":1794558795246},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}