Blesta versions 3.x through 5.x before 5.13.3 contain an insecure deserialization flaw known as object injection. This weakness, classified as CWE-502, allows an attacker to supply a crafted serialized payload that the application accepts and deserializes without proper validation. When the payload is processed, the application may instantiate attacker‑controlled objects, enabling arbitrary code execution and complete takeover of the underlying system.

The affected vendors and products are Blesta CRM/The Blesta Suite, with vulnerable releases from version 3.x up to, but not including, 5.13.3. No additional version details are specified beyond this range.

The vulnerability is rated CVSS 7.5, indicating a high severity. The EPSS score is below 1%, suggesting the probability of a real‑world exploit is low at present, and it is not listed in the CISA KEV catalog. However, the flaw is remotely exploitable via the web interface or any API endpoint that accepts serialized data; no authentication requirement is disclosed, meaning attackers could potentially target public endpoints. Should exploitation occur, the impact would be total compromise of affected systems.