Blesta versions 3.x through 5.x before 5.13.3 suffer from the CORE-5668 object‑injection flaw, which permits an attacker to supply crafted serialized data that is unserialized by the application without proper validation. This vulnerability is classified as CWE‑502 and can lead to remote code execution, allowing the attacker to take full control over the affected system and compromise data confidentiality, integrity, and availability.

The vulnerability affects the Blesta product from the vendor Blesta, specifically all releases in the 3.x, 4.x, and 5.x series prior to version 5.13.3. Users of these versions are at risk regardless of deployment size or geographic location.

The CVSS score of 7.2 denotes a high severity, but the EPSS score being less than 1% indicates a low current exploitation probability and the vulnerability is not yet catalogued in the CISA KEV list. The likely attack vector is remote exploitation through the web interface or exposed APIs, as the flaw stems from deserializing untrusted input. While exploitation requires some application interaction, the lack of immediate exploitation evidence suggests that attackers would need to identify and target specific application instances that expose the vulnerable code path.