AIKIDO-2026-10350

TL;DR

Affected versions of this package unserialize data retrieved from Redis without restricting allowed classes, which may enable PHP Object Injection if the Redis instance is compromised or attacker-controlled. Because unserialize() can instantiate arbitrary PHP objects, malicious serialized payloads could trigger gadget chains through magic methods such as __wakeup() or __destruct(). An attacker who gains write access to Redis could inject crafted serialized objects into stored entries that are later deserialized by the application. It could lead to arbitrary code execution, file manipulation, or privilege escalation depending on available gadget chains in the application or its dependencies.