This vulnerability, identified as CWE-502, involves unsafe deserialization of untrusted data in Timber versions up to 1.23.0. Deserialization flaws can enable attackers to execute arbitrary code or manipulate application state if they can control serialized input. The CVSS 3.1 score of 8.0 reflects a network attack vector requiring high complexity and privileges but no user interaction, with a complete impact on confidentiality, integrity, and availability. Currently, there is no vendor advisory or patch available, and the vulnerability is publicly disclosed.

An attacker with high privileges on the network can exploit this vulnerability to fully compromise the affected Timber application, impacting confidentiality, integrity, and availability. This could lead to unauthorized code execution or data manipulation within the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Timber application to trusted users with high privileges and monitor for unusual activity related to deserialization processes. Avoid processing untrusted serialized data where possible.