This vulnerability (CVE-2026-57621) affects Arraytics Booktics software versions up to 1.0.21 and involves deserialization of untrusted data (CWE-502) leading to unauthenticated PHP Object Injection. An attacker can exploit this remotely without authentication or user interaction to execute arbitrary code, resulting in full compromise of the system's confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no official fix or patch has been provided by the vendor as of the published date.

Successful exploitation allows remote attackers to execute arbitrary PHP code without authentication, potentially leading to complete system compromise including data theft, modification, or denial of service. The CVSS 3.1 base score of 9.8 reflects critical impact on confidentiality, integrity, and availability with an attack vector over the network and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable application, apply web application firewall rules to detect and block suspicious deserialization payloads, and monitor for unusual activity related to PHP object injection attempts.