b2evolution CMS vulnerabilities

2 known vulnerabilities in b2evolution CMS from B2evolution. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  b2evolution CMS: Deserialization of Untrusted Data

  CVE-2026-76834Sep 17, 2026B2evolution

  b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit c

• 7.2 High severity

  b2evolution_cms: Unrestricted Upload of File with Dangerous Type

  CVE-2022-44036Jan 3, 2023B2evolutionEPSS 1.2%

  In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue and if you don't like