CVE-2026-25614 - Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680

HIGH

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680

Published Feb 3, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.59%

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
3.0.0	affected	<5.13.3

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

Link	Providers	Tags
http://seclists.org/fulldisclosure/2026/Feb/2		Mailing ListThird Party Advisory
https://www.blesta.com/2026/01/28/security-advisory/		Vendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Feb 3, 2026

Updated Feb 5, 2026

Reserved Feb 3, 2026

Updated Feb 3, 2026

Status Analyzed

Modified Jun 17, 2026

Severity n/a

Public date n/a