CVE-2026-11860 is a deserialization of untrusted data vulnerability (CWE-502) in OpenSolution Quick.CMS. The product deserializes user-controlled data transmitted over unencrypted HTTP without verifying its integrity or authenticity. This enables attackers to modify serialized payloads in transit and inject malicious objects. Because deserialization occurs without proper validation or class restrictions, crafted payloads can invoke PHP magic methods such as __wakeup() and __destruct(), and leverage gadget chains to achieve arbitrary code execution on the server. Exploitation occurs automatically when an administrator accesses the admin panel. The issue was mitigated by enforcing HTTPS communication in Quick.CMS version 6.8, released on May 14, 2026. Versions prior to 6.8 remain vulnerable.

Successful exploitation allows remote attackers to execute arbitrary code on the server by manipulating serialized data transmitted over an unprotected HTTP channel. This compromises server integrity and can lead to full system compromise. The attack requires an administrator to access the admin panel, which triggers deserialization of the malicious payload.

A patch is available that mitigates this vulnerability by enforcing HTTPS communication, released in Quick.CMS version 6.8 on May 14, 2026. Deployments should upgrade to version 6.8 or later to remediate this issue. Until patched, avoid using the admin panel over unencrypted HTTP channels to reduce risk.