A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization.
The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23.
The affected component should be upgraded.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:open-web-analytics
References 9
https://vuldb.com/vuln/409882
VDB-409882 | Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization
https://vuldb.com/vuln/409882/cti
VDB-409882 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-97865
CVE-2026-97865 | CVE Analysis and Report
https://vuldb.com/submit/911108
Submit #911108 | Open Web Analytics master Insecure Deserialization
https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/960
NVD
https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/967
NVD
https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/78c1222ec0e2119…
NVD
https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.8.2
NVD
https://github.com/Open-Web-Analytics/Open-Web-Analytics/
NVD