CVE-2026-97865

Deferred Deferred - Pending Action

Deserialization Flaw in Open-Web-Analytics

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97865

EUVD

EUVD-2026-87090

Affected Vendors & Products

Vendor	Product	Version / Range
open-web-analytics	open-web-analytics	to 1.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a deserialization flaw in Open-Web-Analytics versions up to 1.8.1. It exists in the Event::loadFromArray function of queue.php, specifically in the Remote Event Queue Endpoint component. Attackers can remotely manipulate data to trigger insecure deserialization, potentially leading to arbitrary code execution or other malicious actions.

Detection Guidance

This vulnerability affects Open-Web-Analytics versions up to 1.8.1. To detect it, check the installed version of Open-Web-Analytics by inspecting the software's version file or running commands like 'grep -r "version" /path/to/open-web-analytics' or 'cat /path/to/open-web-analytics/version.php'. If the version is 1.8.1 or lower, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute arbitrary code on your system, gain unauthorized access, or perform other malicious activities. It may lead to data breaches, system compromise, or disruption of services if the affected component is exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or mishandled due to the flaw.

Mitigation Strategies

Upgrade Open-Web-Analytics to version 1.8.2 or later immediately. The patch is available as commit 78c1222ec0e2119d84684032da1541120a2cdd23. Remove or restrict access to the Remote Event Queue Endpoint if not required. Ensure no untrusted input reaches the deserialization function Event::loadFromArray.

Hi! I’m here to help you understand CVE-2026-97865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70