TrueLayer Plugin Psr16CacheAdapter unserialize deserialization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in TrueLayer Plugin. The impacted element is the function unserialize of the component Psr16CacheAdapter. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2026-103831. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in TrueLayer Plugin (affected version unknown). This affects the function unserialize of the component Psr16CacheAdapter. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.

It is possible to read the advisory at incibe.es. This vulnerability is uniquely identified as CVE-2026-103831 since 10/01/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-93363). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• TrueLayer Plugin

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion