This vulnerability is an unauthenticated PHP object injection in Château versions <= 1.2.1, caused by unsafe deserialization of untrusted data (CWE-502). The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation could lead to full compromise of the affected system, including arbitrary code execution and denial of service. The vulnerability does not require authentication, increasing the risk of remote exploitation. Confidentiality, integrity, and availability impacts are all rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, consider implementing network-level protections such as web application firewalls to detect and block suspicious deserialization payloads targeting Château. Avoid exposing vulnerable versions to untrusted networks.