Skip to content
CVE PROGRAM SOURCE RECORD9.5 Critical

CVE-2025-2244

Insecure PHP deserialization issue in GravityZone Console (VA-12634)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Bitdefender

Description

A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Bitdefender GravityZone Console

Default version status: unaffected

  • 0 to < 6.41.2-1affected

References