UNA CMS versions 9.0.0-RC1 through 14.0.0-RC4 expose a PHP object injection flaw in BxBaseMenuSetAclLevel.php. The vulnerability arises because the profile_id POST parameter is passed directly to PHP unserialize() without sanitization, allowing an attacker to inject arbitrary PHP objects. This flaw can lead to the execution of malicious PHP code, providing full control over the affected web server and compromising confidentiality, integrity, and availability. The weakness is identified as CWE-502.

The affected system is UNA CMS, a content management platform. All releases from version 9.0.0-RC1 up to 14.0.0-RC4 are vulnerable. No specific distribution vendor beyond UNA CMS is listed, but any deployment using these releases is at risk.

The CVSS score of 9.3 reflects the severity of arbitrary code execution possible without authentication. The EPSS score of less than 1% indicates that, despite high severity, the probability of exploitation in the wild is currently low, likely due to limited exposure or discovery. The vulnerability is not yet listed in CISA's KEV catalog. The most probable attack vector is a remote, unauthenticated POST request to the BxBaseMenuSetAclLevel.php endpoint with a crafted profile_id value. An attacker would need to send a serialized payload that instantiates objects capable of performing write and execute operations on the server.