CVE-2026-62051 in Stargaze Plugin
Summary
by MITRE • 10/10/2026
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified as an unauthenticated PHP object injection flaw within the Stargaze application, specifically affecting versions up to and including 1.10, represents a critical security deficiency rooted in improper deserialization practices. This type of vulnerability arises when an application accepts user-supplied input that is directly passed into a function responsible for reconstructing serialized objects without adequate validation or sanitization. In the context of PHP applications like Stargaze, which often rely on serialization to store session data, configuration states, or complex object structures in databases and cookies, this flaw allows attackers to manipulate the internal state of application objects by injecting maliciously crafted payloads. The absence of authentication requirements for this vector significantly escalates its severity, as it enables any remote actor with network access to exploit the issue without needing valid credentials, thereby lowering the barrier to entry for potential adversaries.
From a technical perspective, PHP object injection exploits the magic methods defined within classes, such as __wakeup(), __destruct(), or __toString(). When an attacker provides a serialized string containing references to these special methods along with properties that point to vulnerable functions or system commands, the application's deserialization process automatically executes them. This mechanism can lead to remote code execution if the environment permits it through available gadget chains—sequences of existing classes and their method calls that result in arbitrary command execution without requiring new code uploads. The impact is profound, potentially granting an attacker full control over the underlying server infrastructure, allowing for data exfiltration, modification of application logic, or use as a pivot point for further network attacks. This aligns with Common Weakness Enumeration identifier CWE-502, which describes deserialization of untrusted data, and falls under the MITRE ATT&CK technique T1190, Exploit Public-Facing Application, highlighting its relevance in real-world attack scenarios targeting web services.
The operational impact of this vulnerability extends beyond immediate system compromise to include severe integrity and confidentiality breaches. Attackers can alter user sessions, escalate privileges by manipulating object properties that control access levels, or extract sensitive information stored within the application's internal state. Given that Stargaze is a media management tool often deployed in home server environments where security hygiene may vary, the risk of unauthorized access to personal files and metadata is substantial. Furthermore, because the vulnerability exists prior to authentication checks, it can be automated easily using standard exploitation frameworks like Metasploit or custom scripts written in Python, facilitating widespread scanning and compromise across vulnerable instances on the internet.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running Stargaze versions 1.10 or earlier should upgrade to a patched version where this deserialization flaw has been addressed by implementing strict input validation and whitelisting allowed classes during deserialization processes. If upgrading is not immediately feasible, temporary mitigations include disabling PHP functions that facilitate dangerous operations if they are not strictly required for application functionality, such as unserialize(), or restricting network access to the Stargaze instance via firewall rules to trusted IP addresses only. Additionally, implementing Web Application Firewalls with specific signatures for object injection patterns can provide a layer of defense against exploitation attempts while permanent fixes are deployed. Regular security audits and code reviews focusing on serialization practices are essential to prevent similar vulnerabilities in future development cycles.