[GHSA] GHSA-2ff2-mx52-q8wp (low) — October CMS: PHP Object Injection via Backend Widget Session Storage

GHSA-2ff2-mx52-q8wp Severity: low CVE: CVE-2026-49400

October CMS: PHP Object Injection via Backend Widget Session Storage

The backend `SessionMaker` trait stored widget session state as `base64(serialize(...))` and consumed it with `unserialize()` without an `allowed_classes` restriction. Any code path that could write to a `widget.*` session key with attacker-controlled bytes could trigger PHP