CVE-2025-3590: Adianti Framework RCE Vulnerability

CVE-2025-3590 Overview

CVE-2025-3590 is an insecure deserialization vulnerability in Adianti Framework versions up to and including 8.0. The flaw affects an unknown function within the PHP-based application framework and allows attackers to submit crafted serialized data over the network. Successful exploitation can lead to object injection, enabling manipulation of application state or execution of unintended code paths. The vulnerability requires low-level privileges but no user interaction. A public proof-of-concept has been disclosed, increasing the risk of opportunistic exploitation against exposed Adianti-based applications. The maintainers addressed the issue in version 8.1.

Critical Impact
Remote authenticated attackers can trigger insecure deserialization in Adianti Framework, potentially compromising confidentiality, integrity, and availability of affected applications.

Affected Products

Adianti Framework versions up to and including 8.0
PHP web applications built on Adianti Framework
Adianti Framework 8.1 resolves the issue

Discovery Timeline

2025-04-14 - CVE-2025-3590 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-3590

Vulnerability Analysis

CVE-2025-3590 is classified as an insecure deserialization issue tracked under [CWE-20] (Improper Input Validation). Adianti Framework processes serialized input without validating the object types or contents being reconstructed. When a PHP application deserializes attacker-controlled data, the runtime instantiates arbitrary classes and invokes magic methods such as __wakeup or __destruct. This behavior enables PHP object injection, a well-known exploitation pattern that can pivot to file operations, database queries, or code execution depending on the available gadget chains within the application and its dependencies. A public proof-of-concept is available through a GitHub Gist, lowering the barrier to exploitation. See the GitHub Gist PoC Code and the VulDB #304645 Report for additional technical context.

Root Cause

The root cause is improper validation of serialized input passed to deserialization routines within Adianti Framework. The framework accepts serialized payloads from network-facing entry points without enforcing an allowlist of expected classes or verifying data integrity. Without these controls, any class loaded by the PHP autoloader becomes reachable for instantiation through attacker input.

Attack Vector

An attacker with low-privileged access sends a crafted serialized payload to a vulnerable endpoint over the network. No user interaction is required. The malicious object triggers gadget chains during reconstruction, allowing the attacker to influence application behavior. Because the exploit has been publicly disclosed, opportunistic scanning against exposed Adianti Framework deployments is a realistic threat scenario.

No verified exploit code is reproduced here. Refer to the GitHub Gist PoC Code for the published proof-of-concept and to the VulDB #304645 Detailed Info for indexed vulnerability metadata.

Detection Methods for CVE-2025-3590

Indicators of Compromise

Inbound HTTP requests containing PHP serialized object markers such as O: or a: in POST bodies, query strings, or cookies targeting Adianti endpoints.
Unexpected instantiation of framework or third-party classes reflected in PHP error logs or application traces.
Outbound network connections or file-system modifications originating from PHP-FPM or web-server processes without a corresponding legitimate request path.

Detection Strategies

Inspect web-server and application logs for serialized payload patterns and abnormal parameter sizes on endpoints that accept form or API input.
Enable PHP error and exception logging to capture failed class autoload attempts, which often accompany failed deserialization exploitation.
Deploy web application firewall (WAF) rules that flag serialized object signatures in user-supplied parameters.

Monitoring Recommendations

Monitor process lineage from web-server workers for spawned shells, curl, wget, or scripting interpreters that indicate post-exploitation activity.
Track file writes to web-accessible directories, /tmp, and framework cache paths for anomalous PHP files.
Correlate authentication events with subsequent request bursts to identify low-privilege accounts being used to deliver serialized payloads.

How to Mitigate CVE-2025-3590

Immediate Actions Required

Upgrade Adianti Framework to version 8.1 or later, which contains the vendor fix for this deserialization issue.
Inventory all applications built on Adianti Framework and confirm the running version through composer metadata or release notes.
Restrict network exposure of Adianti-based applications until the upgrade is validated in production.
Rotate credentials, session tokens, and API keys that could have been exposed if exploitation is suspected.

Patch Information

The maintainers resolved CVE-2025-3590 in Adianti Framework version 8.1. Administrators should upgrade to 8.1 or a later release. Consult the VulDB #304645 Report and VulDB Submission #550296 for tracking metadata and vendor references.

Workarounds

Place a WAF in front of Adianti-based applications and block requests containing serialized PHP object patterns in untrusted parameters.
Enforce strict authentication and network access controls so that only trusted users can reach endpoints that process serialized data.
Audit custom controllers and services for direct calls to unserialize() on request data, and replace them with safe formats such as JSON where feasible.

bash

# Verify installed Adianti Framework version via composer
composer show adianti/framework | grep versions

# Upgrade to the fixed release
composer require adianti/framework:^8.1