This vulnerability is a PHP Object Injection in Modula Image Gallery versions <= 2.14.18, caused by unsafe deserialization of untrusted data (CWE-502). It allows an attacker with high privileges to inject malicious PHP objects, potentially leading to full system compromise. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. The attacker must have high privileges to trigger the vulnerability, but once exploited, the impact is severe, potentially allowing arbitrary code execution or other malicious actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the Modula Image Gallery plugin and monitor for suspicious activity related to deserialization processes. Avoid using affected versions in untrusted environments.