CVE-2026-48909

CVE-2026-48909 describes a deserialization vulnerability found in the SP LMS (com_splms) extension for Joomla, specifically affecting versions prior to 4.1.4. This flaw stems from the extension's improper handling of user-controlled cookie data, which is deserialized without adequate validation. An unauthenticated remote attacker can exploit this vulnerability by injecting a crafted PHP object into the `lmsOrders` cookie. This malicious input is then base64-decoded and passed directly to the `unserialize()` function, enabling the attacker to execute arbitrary code on the server. The vulnerability is classified under CWE-502, pertaining to the deserialization of untrusted data.