{"uuid": "88752d32-b3e2-413f-be5c-6ec2e498b08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27218", "type": "seen", "source": "https://t.me/hackeronereports/244", "content": "\ud83c\udfaf New Report #3090123: insecure deserilize object leads to RCE On Sitecore (CVE-\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588-27218)\n\ud83d\udd3aSeverity: Critical\n\ud83d\udc7d Reporter: reinhardtthe\n\ud83d\udcbc Team: Mars\n\ud83d\udcb5 Bounty: null\n\ud83d\udd50 Submitted: 2025-04-12\n\u23f0 Disclosed: 2025-05-12 16:04:46\n\ud83d\udcdd Summary: This critical vulnerability involved an insecure deserialization issue in Sitecore implementation, which was assigned CVE-2025-27218. The vulnerability allowed remote code execution through unsanitized user input in the ThumbnailsAccessToken header. The vulnerability was remediated by removing public access to the affected site, which was then protected behind Cloudflare WAF.\n  @hackeronereports", "creation_timestamp": "2026-09-14T06:00:04.871227Z"}