Read the docs
TI-2022-18632 Aliases CVE-2022-39256GHSA-gfhp-jgp6-838j

Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Priority MEDIUM 44CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01663 76th percentileScored 2026-11-07
Fix Fixed C1-CMS-Foundation (Orckestra): 6.13CompositeC1.Core (NuGet): 6.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OrckestraC1-CMS-Foundationbefore 6.136.13Patch availableCNA
—CompositeC1.Core (NuGet)before 6.136.13Patch availableGHSA-gfhp-jgp6-838j
  • C1-CMS-Foundation VendorOrckestra Affected before 6.13 Fixed in 6.13 Patch available CNA
  • CompositeC1.Core (NuGet) Vendor— Affected before 6.13 Fixed in 6.13 Patch available GHSA-gfhp-jgp6-838j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:orckestra:c1_cms:*:*:*:*:*:*:*:*before 6.13VulnerableOrckestra
  • cpe:2.3:a:orckestra:c1_cms:*:*:*:*:*:*:*:* Versions before 6.13 Vulnerable ·Orckestra

Remediation

  • Fix · CNA C1-CMS-Foundation (Orckestra) Fixed in 6.13
  • Fix · GHSA-gfhp-jgp6-838j CompositeC1.Core (NuGet) Fixed in 6.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39256
  2. 2026-10-03 Alias added: GHSA-gfhp-jgp6-838j

References

Patch 1

Advisory 3

Other 2

  • TI-2021-13979 Deserialization of untrusted data in Orckestra C1 CMS CVSS 3.1HIGH 8.8
  • TI-2019-13230 An issue was discovered in Orckestra C1 CMS through 6.6. CVSS 3.1HIGH 8.8
  • TI-2022-08602 Deserialization of untrusted data in C1 CMS. CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences