Technical impact
openITCOCKPIT is an open source monitoring tool that, in Community Edition 5.3.1 and earlier, uses PHP unserialize() to process changelog entries without restricting the classes that can be deserialized. The code accepts serialized data that could, in theory, be derived from attacker‑influenced application state. This creates a latent PHP object injection vulnerability: if an attacker supplies crafted serialized data, malicious PHP objects could be instantiated, potentially leading to remote code execution. No public endpoint currently injects objects into this data path, so the flaw is not immediately exploitable.
Affected Systems
Affected users are those running openITCOCKPIT Community Edition 5.3.1 or earlier. The vulnerability was addressed in later releases, specifically the 5.4.0 release, as indicated by the project’s release notes and commit reference. The impact applies to the openITCOCKPIT product from the vendor openITCOCKPIT.
Risk and Exploitability
The CVSS score of 7.5 reflects a high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. If future code modifications, plugins, or refactors introduce PHP objects into the changelog data path, the flaw could become immediately exploitable with severe impact. The inferred attack vector is the deserialization of attacker‑controlled input into the changelog handling routine.
