CVE-2022-39297
Deserialization of untrusted data in MelisCms
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Deserialization of untrusted data in MelisCms
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Record
CVE-2022-39297- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2022-7122
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Record
EUVD-2022-7122- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m3m3-6gww-7gj9
melisplatform/melis-cms vulnerable to deserialization of untrusted data
Impact
Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.
Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1.
Patches
This issue was addressed by restricting allowed classes when deserializing user-controlled data.
References
For more information
If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
- Record
GHSA-m3m3-6gww-7gj9- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Record
CVE-2022-39297- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Deserialization of untrusted data in MelisCms
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Record
CVE-2022-39297- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-m3m3-6gww-7gj9
melisplatform/melis-cms vulnerable to deserialization of untrusted data
Impact
Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.
Users should immediately upgrade to melisplatform/melis-cms >= 5.0.1.
Patches
This issue was addressed by restricting allowed classes when deserializing user-controlled data.
References
For more information
If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
- Record
GHSA-m3m3-6gww-7gj9- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
melisplatform/melis-cmsPackagist |
before 5.0.1 | 5.0.1 |
melisplatform/melis-cmsPackagist |
before 5.0.1, plus listed versions v2.1v2.1.1v2.2.0v2.2.1v2.3.0 Show 45 moreShow lessv2.3.1v2.4.0v2.5.0v3.0.0v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v4.0.0v4.0.1 |
5.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39297 is a high vulnerability (CVSS 7.7) in Melisplatform Melis-cms, published October 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 69th percentile. Fixed in melisplatform/melis-cms 5.0.1.
References
github.com/melisplatform/melis-cms/security/advisories/GHSA-m3m3-6gww-7gj9
nvd.nist.gov/vuln/detail/CVE-2022-39297
Left out here: 14 versions. The JSON record has them.