This vulnerability (CVE-2026-65552) affects qstudio Export User Data versions <= 2.2.6 and is caused by unsafe deserialization of untrusted data, leading to PHP object injection. This flaw allows an attacker to potentially execute arbitrary code or manipulate application behavior by injecting crafted serialized objects. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the published date.

Successful exploitation could lead to complete compromise of the affected system, including unauthorized code execution, data manipulation, and service disruption. The critical CVSS score reflects the potential for severe damage to confidentiality, integrity, and availability of the system running the vulnerable software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.