CVE-2026-14637 describes a remote deserialization vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap software, specifically within the getCartItems function of application/libraries/ShoppingCart.php. The vulnerability arises from improper handling of the shopping_cart argument, allowing an attacker to perform unsafe deserialization remotely. The product uses continuous delivery with rolling releases, so no explicit affected or fixed version numbers are provided. A patch commit identifier (49b20f53de2b7ec34e920b11c863f1491d911a04) has been referenced to address this issue. The CVSS 4.0 base score is 8.8 (high severity), indicating a network attack vector with no privileges or user interaction required, and high impact on availability.

Successful exploitation of this vulnerability can lead to remote code execution or other impacts related to unsafe deserialization, potentially compromising the affected system. The CVSS score of 8.8 reflects a high severity with significant impact on availability and no required privileges or user interaction. The vulnerability can be exploited remotely by manipulating the shopping_cart argument.

A patch addressing this vulnerability has been identified (commit 49b20f53de2b7ec34e920b11c863f1491d911a04). It is recommended to apply this patch promptly. Due to the continuous delivery model of the product, users should update to the latest release containing this fix. Patch status is not explicitly confirmed in vendor advisories; therefore, users should verify the application of the patch in their deployment. No other specific mitigations are provided.