CVE-2025-66571 is a deserialization of untrusted data vulnerability in UNA CMS affecting versions 9.0.0-RC1 to 14.0.0-RC4. The vulnerability arises because the profile_id POST parameter is passed directly to PHP's unserialize() function in the BxBaseMenuSetAclLevel.php file without proper validation or sanitization. This flaw enables remote attackers with no authentication to inject crafted PHP objects, which can lead to arbitrary PHP code execution on the server. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the UNA CMS installation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint if possible and monitor for suspicious activity related to the profile_id POST parameter. Avoid exposing UNA CMS installations to untrusted networks or users.