security: AkeebaImporter uses unserialize() on untrusted filter data #75

New Issue

2026-06-21T23:01:12Z

jmiller commented

2026-06-21 23:01:12 +00:00

Severity: HIGH

AkeebaImporter at line 368 uses @unserialize($raw) on #__ak_profiles.filters data read from the database. PHP object injection via unserialize() is a known RCE vector when classes with __destruct()/__wakeup() are available.

Akeeba Backup has used JSON-encoded filters since v7+.

Fix

Replace unserialize() with json_decode(). If JSON parse fails, treat filters as empty.

File

src/Engine/AkeebaImporter.php:368-370

## Severity: HIGH `AkeebaImporter` at line 368 uses `@unserialize($raw)` on `#__ak_profiles.filters` data read from the database. PHP object injection via `unserialize()` is a known RCE vector when classes with `__destruct()`/`__wakeup()` are available. Akeeba Backup has used JSON-encoded filters since v7+. ## Fix Replace `unserialize()` with `json_decode()`. If JSON parse fails, treat filters as empty. ## File - `src/Engine/AkeebaImporter.php:368-370`

jmiller added the component: engine label 2026-06-21 23:01:12 +00:00

jmiller referenced this issue

2026-06-21 23:04:13 +00:00

test: Deep dive audit — verify and fix all findings #81

jmiller referenced this issue from a commit

2026-06-21 23:09:43 +00:00

fix: critical and high audit findings (#81)

jmiller referenced this issue from a commit

2026-06-21 23:17:16 +00:00

fix: remaining audit findings — OOM, security, error handling (#81)

jmiller referenced a pull request that will close this issue

2026-06-21 23:17:31 +00:00