VulnerabilityPublished 11 May 2026

torrentpier/torrentpier · torrentpier has PHP Serialize Injections

Affects torrentpier/torrentpierSource GCVE Database

Severity

Critical

Rated by Threat Radar

Patch: Available – fixed in 2.4.4

Data as of 27 Oct 2026, 00:28 UTC

What to do

Upgrade torrentpier/torrentpier to 2.4.4.

Affected software

Product	Affected	Fixed in
Packagisttorrentpier/torrentpier	Affected <2.4.4	Fixed in 2.4.4

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available in torrentpier version 2.4.4. Users should upgrade to version 2.4.4 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.

Description

Torrentpier versions prior to 2.4.4 contain PHP Serialize Injection vulnerabilities. These flaws allow attackers to manipulate serialized objects, potentially leading to code execution or unauthorized file reading. The issue is classified under CWE-502 and is considered critical. A fix is available in version 2.4.4.

Impact

An attacker exploiting this vulnerability can execute arbitrary code or read arbitrary files on the vulnerable system by injecting malicious data into serialized PHP objects. This can lead to full system compromise or data leakage. The severity is critical due to the potential for remote code execution.

Summary

The torrentpier project has PHP Serialize Injection vulnerabilities that enable attackers to modify serialized objects to inject malicious data. This can result in arbitrary code execution or unauthorized file access on affected systems. The vulnerability is identified as CWE-502. The affected versions are all releases before 2.4.4, which contains the fix. No public exploit code or in-the-wild exploitation is currently known. The vulnerability was discovered through automated and manual code review by the PHP Secure vulnerability scanner team.

CWE-502Deserialization of Untrusted Data (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #15OWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Implementation
Explicitly define a final object() to prevent deserialization.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.2 (opens in a new tab)
V5.5.3 (opens in a new tab)
V5.5.1 (opens in a new tab)
Attack patterns
Object Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Oct 2026, 00:28 UTC

WeaknessesCWE-502

Technical details

References

Community reviews

Related threats