A deserialization flaw exists in the CuteNews application when processing the __post_data parameter via the cn_parse_url function. The function accepts base64‑encoded, serialized PHP objects without validating their contents, allowing an attacker to craft a payload that injects arbitrary values into internal request variables, such as __referer. By manipulating these variables the attacker can alter request routing, potentially bypass authentication or trigger unintended code paths, which may lead to remote code execution if the application later interprets the injected data in an executable context.

CuteNews version 2.1.2 is affected. The vulnerability is triggered whenever this version processes POST data containing the __post_data parameter, and no other versions are currently known to be impacted.

Based on the description, the vulnerability is triggered by supplying a __post_data parameter via a POST request. Therefore, the likely attack vector is an unauthenticated HTTP POST to the publicly exposed CuteNews instance. With a CVSS score of 5.8 and an EPSS score of < 1%, and since the issue is not catalogued in CISA KEV, the vulnerability is considered of moderate severity. The nature of deserializing untrusted data combined with the ability to modify request variables indicates a high exploitation likelihood; if the application later executes code based on these variables, remote code execution becomes possible, making this a significant threat without patching.