Quick.CMS receives serialized data over unencrypted HTTP and does not validate or authenticate it. The deserialization routine accepts user‑controlled objects, allowing an attacker to modify the payload in transit and inject malicious objects that trigger PHP magic methods such as __wakeup() and __destruct(). This flaw, classified as CWE‑502 (Deserialization of Untrusted Data) and CWE‑94 (Improper Constraint on Operations with Update or Delete), enables arbitrary code execution on the server when an administrator accesses the admin panel, which automatically triggers the vulnerable deserialization.

OpenSolution Quick.CMS versions prior to 6.8 are affected. The vendor released a patch on 14.05.2026 that limits communication to HTTPS; deployments that have not applied this patch remain vulnerable.

The CVSS score of 7.5 indicates a high severity issue. The EPSS score is not available, making it hard to estimate current exploitation likelihood. The vulnerability is not yet listed in the CISA KEV catalog. The primary attack vector is network‑based: an attacker can intercept or inject malicious serialized payloads over plaintext HTTP to the admin interface, requiring that the target user authenticate as an administrator. Because the flaw leads to remote code execution and is easy to prove, the risk to affected systems is significant if the patch is not applied.