CVE-2026-11860: Quick.CMS RCE Vulnerability

CVE-2026-11860 Overview

CVE-2026-11860 is an insecure deserialization vulnerability [CWE-94] in Quick.CMS, developed by OpenSolution. The application deserializes user-controlled data transmitted over plaintext HTTP without integrity or authenticity checks. Attackers positioned on the adjacent network can tamper with serialized payloads in transit and inject malicious PHP objects. Crafted payloads trigger dangerous magic methods such as __wakeup() and __destruct(), enabling gadget chains that lead to arbitrary code execution. Exploitation occurs automatically when an administrator accesses the admin panel. OpenSolution mitigated the issue by enforcing HTTPS in a patch for version 6.8 released on 14 May 2026.

Critical Impact
Adjacent-network attackers can achieve arbitrary code execution on the server by manipulating serialized data delivered to an authenticated administrator over an unprotected channel.

Affected Products

OpenSolution Quick.CMS versions prior to 6.8 (patched release dated 14 May 2026)
Quick.CMS deployments configured to communicate over plaintext HTTP
Any Quick.CMS instance that has not applied the HTTPS-enforcement patch

Discovery Timeline

2026-06-15 - CVE-2026-11860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11860

Vulnerability Analysis

Quick.CMS transmits serialized PHP objects between client and server over plaintext HTTP. The application accepts and deserializes the received payload without validating its integrity, authenticity, or the classes it instantiates. An attacker with adjacent network access, such as on a shared wireless segment or a compromised intermediary, can intercept and modify these payloads before they reach the server. When the administrator opens the admin panel, the tampered payload is automatically deserialized, instantiating attacker-chosen objects. These objects invoke PHP magic methods such as __wakeup() and __destruct() during their lifecycle, which can be chained into a gadget chain that executes arbitrary commands within the web server process.

Root Cause

Two design flaws combine to produce the vulnerability. First, the deserialization routine lacks class allow-listing and skips integrity verification of serialized blobs. Second, communication occurs over HTTP, providing no transport-layer protection against tampering. The result is a classic object injection sink reachable by any adversary capable of modifying traffic in transit.

Attack Vector

The attack requires the adversary to occupy a network position that permits modification of HTTP traffic between the administrator and the Quick.CMS server. The attacker rewrites the serialized payload in flight, embedding a gadget chain crafted from classes available in the Quick.CMS runtime. No additional administrator interaction is required beyond logging into the admin panel, which triggers deserialization automatically.

No verified exploit code is publicly available. For technical analysis, refer to the CERT.PL advisory for CVE-2026-11860 and the OpenSolution homepage.

Detection Methods for CVE-2026-11860

Indicators of Compromise

Unexpected PHP processes spawning shell interpreters or outbound network connections from the Quick.CMS web server
Modifications to files within the Quick.CMS installation directory that do not correspond to legitimate administrative actions
Anomalous serialized payloads (strings beginning with O:, a:, or s:) appearing in HTTP request bodies or cookies destined for the admin panel

Detection Strategies

Inspect HTTP traffic to Quick.CMS admin endpoints for serialized PHP object signatures, particularly when delivered over port 80
Alert on web server child processes invoking sh, bash, cmd.exe, or interpreters such as python and perl
Correlate administrator login events with subsequent file writes or process creations on the host

Monitoring Recommendations

Capture and review web server access logs for POST requests to the admin panel containing serialized data structures
Monitor for plaintext HTTP sessions to Quick.CMS hosts that should be served exclusively over HTTPS
Track outbound connections from the web server to non-business destinations following admin panel access

How to Mitigate CVE-2026-11860

Immediate Actions Required

Upgrade Quick.CMS to version 6.8 or later, which enforces HTTPS for the affected communication channel
Configure the web server and application to redirect all HTTP traffic to HTTPS and reject plaintext requests to admin endpoints
Restrict administrative access to trusted networks or via VPN until patching is complete

Patch Information

OpenSolution published a patch for Quick.CMS version 6.8 on 14 May 2026 that limits the affected communication to HTTPS. Deployments without this patch remain exploitable. Refer to the CERT.PL advisory for vendor patch details.

Workarounds

Deploy a TLS-terminating reverse proxy in front of Quick.CMS and disable HTTP listeners on the origin
Issue and install a valid TLS certificate, and configure HTTP Strict Transport Security (HSTS) on the administrative hostname
Limit administrative panel access to IP ranges or VPN endpoints that the organization controls end-to-end

bash

# Example nginx redirect enforcing HTTPS for Quick.CMS
server {
    listen 80;
    server_name cms.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name cms.example.com;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
    # ssl_certificate / ssl_certificate_key directives here
}