CVE-2026-116389

{
  "etk_id": "ETK-2026-2876",
  "cve_id": "CVE-2026-116389",
  "display_id": "CVE-2026-116389",
  "ghsa_id": "GHSA-9r7q-mmwg-3fhm",
  "euvd_id": "EUVD-2026-112118",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in phoenix-media-rename",
  "summary": "Phoenix Media Rename versions through 3.13.5 are affected by unsafe deserialization that can enable object injection. An attacker with the required application privileges may be able to exploit the issue.",
  "mitigation": "Disable or remove Phoenix Media Rename where it is not required, and restrict access to privileged application accounts. Monitor the vendor or package source for a fixed release and update promptly when one is published.",
  "vendor": "crossi72",
  "product": "Phoenix Media Rename",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.13.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "phoenix-media-rename",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.009955216666666667,
  "t0_at": "2026-10-28T14:02:56.685000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T14:49:58.293989+00:00",
      "days": 0.03265751144675926,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T14:02:56.685000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T14:02:56.685000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T14:02:56.685000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116389"
    }
  }
}