CVE-2026-94065

{
  "etk_id": "ETK-2026-1097",
  "cve_id": "CVE-2026-94065",
  "display_id": "CVE-2026-94065",
  "ghsa_id": "GHSA-g7x9-vgq3-cr7j",
  "euvd_id": "EUVD-2026-95785",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in ColorFolio colorit",
  "summary": "ColorFolio installations through version 1.3 are affected by unsafe deserialization in the colorit component. An attacker may be able to inject PHP objects where they can supply data to the vulnerable deserialization path; the evidence does not establish the required access level.",
  "mitigation": "Update ColorFolio when a vendor-fixed release becomes available. Until then, reduce exposure by limiting untrusted users' ability to submit data or access theme functionality that processes serialized input.",
  "vendor": "BuddhaThemes",
  "product": "ColorFolio",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "colorit",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0029,
  "epss_percentile": 0.2005,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 34.27365075,
  "t0_at": "2026-10-09T14:00:10.127000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T21:08:24.069604+00:00",
      "days": 0.2973835949537037,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T14:00:10.127000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T14:00:10.127000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T14:00:10.127000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94065"
    }
  }
}