Deserialization of untrusted data in MelisFront
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-front`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-front` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Melis Technology | melis-front | up to 5.0.0 | — | No fix listed | CNA |
| — | melisplatform/melis-front (Packagist) | before 5.0.1 | 5.0.1 | Patch available | GHSA-h479-2mv4-5c26 |
- melis-front VendorMelis Technology Affected up to 5.0.0 Fixed in — No fix listed CNA
- melisplatform/melis-front (Packagist) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-h479-2mv4-5c26
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:melistechnology:meliscms:*:*:*:*:*:*:*:* | before 5.0.1 | Vulnerable | Melis Technology |
- cpe:2.3:a:melistechnology:meliscms:*:*:*:*:*:*:*:* Versions before 5.0.1 Vulnerable ·Melis Technology
Remediation
- Fix · GHSA-h479-2mv4-5c26 melisplatform/melis-front (Packagist) Fixed in 5.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39298
- 2026-10-03 Alias added: GHSA-h479-2mv4-5c26
References
More Melis Technology Meliscms vulnerabilities
- TI-2022-18673 Deserialization of untrusted data in MelisCms CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-39298 · CVE Program
- CVE-2022-39298 · NVD
- FIRST EPSS
- GHSA-h479-2mv4-5c26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences