This vulnerability (CVE-2026-39445) involves unauthenticated PHP Object Injection in PressLayouts Alukas before version 3.0.0, caused by unsafe deserialization of untrusted data (CWE-502). The CVSS 3.1 score is 8.1, indicating high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to perform PHP Object Injection, potentially leading to remote code execution or other severe impacts on confidentiality, integrity, and availability of the system running vulnerable versions of Alukas. The vulnerability is exploitable remotely without authentication, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable application and monitor for suspicious activity related to PHP object deserialization. Avoid exposing the application to untrusted inputs that may trigger deserialization.