CVE-2026-97865: Deserialization in Open-Web-Analytics
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.
AI Analysis
Technical Summary
This vulnerability exists in Open-Web-Analytics up to version 1.8.1 within the Event::loadFromArray function of the queue.php file in the Remote Event Queue Endpoint component. An attacker can remotely manipulate input to trigger unsafe deserialization, potentially leading to security issues. The vulnerability is addressed by upgrading to version 1.8.2, which includes a patch identified by commit 78c1222ec0e2119d84684032da1541120a2cdd23.
Potential Impact
The vulnerability allows remote attackers to perform deserialization attacks, which can lead to partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector (VC:L, VI:L, VA:L). The CVSS score of 6.9 reflects a medium severity impact with network attack vector, low attack complexity, and no privileges or user interaction required.
Mitigation Recommendations
Upgrade Open-Web-Analytics to version 1.8.2, which contains the official fix for this deserialization vulnerability. No other mitigations are specified or required once the upgrade is applied.
CVE-2026-97865: Deserialization in Open-Web-Analytics
Description
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.
CVSS v4.0
Score 6.9medium
Affected software
Open-Web-Analytics
pkg:github/open-web-analytics/Open-Web-Analyticscpe:2.3:a:open-web-analytics:open-web-analytics:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in Open-Web-Analytics up to version 1.8.1 within the Event::loadFromArray function of the queue.php file in the Remote Event Queue Endpoint component. An attacker can remotely manipulate input to trigger unsafe deserialization, potentially leading to security issues. The vulnerability is addressed by upgrading to version 1.8.2, which includes a patch identified by commit 78c1222ec0e2119d84684032da1541120a2cdd23.
Potential Impact
The vulnerability allows remote attackers to perform deserialization attacks, which can lead to partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector (VC:L, VI:L, VA:L). The CVSS score of 6.9 reflects a medium severity impact with network attack vector, low attack complexity, and no privileges or user interaction required.
Mitigation Recommendations
Upgrade Open-Web-Analytics to version 1.8.2, which contains the official fix for this deserialization vulnerability. No other mitigations are specified or required once the upgrade is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-25T08:15:02.345Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab67f26f7a7c54106db3e8b
Added to database: 09/25/2026, 14:03:18 UTC
Last enriched: 09/25/2026, 14:18:08 UTC
Last updated: 09/26/2026, 02:49:31 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.