SOY CMS improperly deserializes untrusted input, allowing an attacker to inject malicious serialized objects that are executed with the privileges of the web server. This flaw is a classic instance of arbitrary code execution, granting full control over the affected server and compromising confidentiality, integrity, and availability.

The vulnerability affects Tsuyoshi Saito’s SOY CMS. Specific affected versions are not listed in the advisory, so all releases that still support unfiltered deserialization are potentially impacted. Administrators should verify the version of SOY CMS they are running against any vendor updates that address this issue.

The CVSS score of 9.3 indicates critical severity. The EPSS score is 0.00419, indicating a very low but nonzero exploitation probability. The lack of a CISA KEV listing does not reduce the risk; the flaw remains exploitable assuming the web server allows deserialization of attacker‑controlled data. The likely attack vector is via a GET/POST request that contains malicious serialized payloads shown in the web application's input handling logic. Once triggered, the attacker can run arbitrary commands on the server. Acting promptly to patch or mitigate is therefore essential.