AIKIDO-2025-10842

TL;DR

Affected versions of this package are vulnerable to arbitrary code execution because they call unserialize() on user-supplied files without restricting which classes may be instantiated. This allows attackers to perform PHP object injection and potentially trigger malicious gadget chains. The issue is fixed by invoking unserialize() with allowed_classes => false, which prevents custom objects from being created while still allowing arrays and stdClass values. This preserves backward compatibility with existing serialized array files while effectively blocking RCE via unsafe object deserialization.