CVE-2026-97865

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-97865

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97865.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-97865

Published

2026-09-25T13:30:14Z

Modified

2026-09-27T03:47:33Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

Details

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-20",
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97865.json"
}

References

Affected packages

Git / github.com/open-web-analytics/open-web-analytics

Affected ranges

Type

GIT

Repo

https://github.com/open-web-analytics/open-web-analytics

Events

Introduced

727b3d0690ff214934a791c81540f7982f71631b

Fixed

78c1222ec0e2119d84684032da1541120a2cdd23

Fixed

b6e030b9b123ac7d73f5fa0fe03962eb86cf1309

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.8.0"
        },
        {
            "last_affected":  "1.8.0"
        },
        {
            "introduced":  "1.8.1"
        },
        {
            "last_affected":  "1.8.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.8.0

1.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97865.json"