An unsafe deserialization sink in the openITCOCKPIT Gearman worker allows an attacker to craft serialized PHP objects that are unserialized without validation, which can lead to PHP Object Injection and ultimately Remote Code Execution within the worker process. This flaw is the type CWE-502, and it can compromise confidentiality, integrity, and availability of the system by allowing the attacker to execute arbitrary code on the host running the worker.

The vulnerability affects openITCOCKPIT software, versions 5.3.1 and earlier. The affected component is the Gearman worker function registered as oitc_gearman, and the issue remains in code regardless of deployment configuration until the upgrade to 5.4.0 or later.

The CVSS score is 7.5 with an EPSS score of less than 1%, and it is not listed in CISA’s KEV catalog. Exploitation is feasible when Gearman is accessible on non‑local interfaces or when TCP port 4730 is open to untrusted systems. The likely attack vector is via network access to the Gearman service, which would allow an attacker to submit a malicious payload and trigger the object injection. The risk is moderate to high for environments with misconfigured or exposed Gearman services.