Threats affecting pkg:github/b2evolution CMS

b2evolution CMS versions 6.7.8 through 7.2.5 contain a deserialization vulnerability due to an incomplete fix for CVE-2016-8901. The vulnerability allows unauthenticated attackers to submit crafted serialized PHP objects with negative integer array keys that bypass validation and reach the unserialize() function. This can lead to instantiation of arbitrary PHP objects with attacker-controlled properties, potentially enabling code execution if suitable gadget chains exist.