CVE-2026-118074 in Finale Lite Plugin
Summary
by MITRE • 10/29/2026
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as a PHP Object Injection flaw within Finale Lite version 2.21.0 and earlier represents a critical security risk for applications relying on this e-commerce platform. This type of vulnerability arises from the unsafe deserialization of user-controllable data, allowing an attacker to manipulate the internal state of the application by injecting malicious serialized objects. In the context of PHP-based web applications, object injection occurs when untrusted input is passed directly into functions such as unserialize() without proper validation or sanitization. This allows attackers to craft specific payloads that exploit existing classes within the application's codebase or included libraries, leading to unintended side effects during the deserialization process.
The technical root cause lies in the shop manager functionality of Finale Lite, where input parameters are likely processed through a mechanism that reconstructs PHP objects from serialized strings provided by the user. When an attacker submits a specially crafted request containing a maliciously constructed serialized object, the application attempts to deserialize this data into memory. If the application has access to classes with magic methods such as __wakeup(), __destruct(), or __toString(), these methods are executed automatically during deserialization. By chaining these method calls, often referred to as gadget chains, an attacker can achieve arbitrary code execution, remote command execution, or other severe outcomes depending on the available libraries and their capabilities within the server environment.
From a classification perspective, this vulnerability aligns with CWE-502, which denotes Deserialization of Untrusted Data. This weakness is prevalent in modern web applications that utilize object-oriented programming paradigms where state persistence relies heavily on serialization mechanisms. The exploitation of this flaw does not necessarily require authentication if the vulnerable endpoint is accessible to unauthenticated users or if session cookies can be manipulated by a logged-in user with lower privileges, such as a standard shop manager role who might have access to certain configuration or import features that trigger the deserialization logic.
The operational impact of successfully exploiting this PHP Object Injection vulnerability is severe and multifaceted. An attacker could gain full control over the underlying server hosting the Finale Lite application. This level of compromise enables the theft of sensitive customer data, including credit card information and personal identifiable information stored in the database. Furthermore, it allows for complete defacement of the website, insertion of web shells for persistent access, or using the compromised server as a pivot point to attack other systems within the internal network. The integrity of business operations is also at risk, as attackers can modify product listings, prices, and order histories, leading to significant financial loss and reputational damage.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if arbitrary code execution is achieved through the gadget chain. It also relates to T1190, Exploit Public-Facing Application, as it targets a web-facing component of the software. The attack vector typically involves HTTP requests where specific parameters are manipulated to include the malicious serialized payload, often hidden within common headers or POST data fields that appear benign but contain encoded object structures designed to trigger the vulnerable code paths upon processing by the server-side PHP engine.
Mitigation strategies must focus on immediate remediation and long-term architectural improvements. The most effective solution is to upgrade Finale Lite to a version greater than 2.21.0, where this specific deserialization flaw has presumably been patched by the developers through input validation or removal of unsafe deserialization calls. For organizations unable to patch immediately, implementing strict allowlists for serialized classes can prevent the instantiation of unexpected objects. Additionally, enabling PHP configuration directives such as phar.readonly and disabling dangerous functions like unserialize() in contexts where they are not strictly necessary can reduce the attack surface. Web Application Firewalls (WAFs) may also be configured to detect patterns associated with PHP serialization payloads, providing a layer of defense-in-depth against exploitation attempts while permanent fixes are deployed.