CVE-2014-2293: Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection...

Security readout for executives and security teams

CVE-2014-2293 is a remote PHP object injection issue in Zikula Application Framework before 1.3.7 build 11. A vulnerable public site could let an attacker tamper with serialized input and potentially delete files or execute PHP code. Treat exposed legacy Zikula systems as urgent to find and remove or upgrade. Exposure is most likely on internet-facing Zikula Application Framework installations older than 1.3.7 build 11. The source bundle lists generic affected product data as n/a, so asset discovery should focus on application identification, version evidence, and any legacy Zikula deployments. Prioritize this for any legacy public Zikula site because the stated impact includes remote code execution and file deletion. If no Zikula systems exist, document non-exposure and close after validation. Mitigation focus: Identify any Zikula Application Framework deployments and confirm exact version and build.; Upgrade systems running versions before 1.3.7 build 11 using vendor-supported guidance.; If upgrade is not immediate, restrict public access to vulnerable Zikula instances..

Prepared

Jun 7, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.