Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.

Affected: Blesta

-------------------------------------------------------------------------------- Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities --------------------------------------------------------------------------------

[-] Software Link:

https://www.blesta.com

[-] Affected Versions:

All versions from 3.0.0 to 5.13.1.

[-] Vulnerabilities Description:

The vulnerabilities exist because user input passed through the "vars" and "order_info" POST parameters when dispatching the /app/controllers/admin_clients.php script, and through the "$group_name" POST parameter when dispatching the /app/controllers/admin_company_groups.php script, is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by malicious administrator users to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code (RCE).

[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2026-25615.php

[-] Solution:

Apply the vendor patch or upgrade to version 5.13.2 or later.

[-] Disclosure Timeline:

[19/01/2026] - Vendor notified

[20/01/2026] - Vendor response stating: “this issue was previously identified during an internal security review”

[22/01/2026] - CVE identifier requested

[28/01/2026] - Version 5.13.2 released

[31/01/2026] - Version 5.13.3 released to address regressions introduced in 5.13.2

[03/02/2026] - CVE identifier assigned…

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.