What’s Vulnerable › Vulnerabilities

CVE-2022-39256: Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-27 · updated 2026-06-17
• Weakness: CWE-502

Description

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

Affected products

• Orckestra C1-CMS-Foundation: before 6.13 — fixed in 6.13

How to fix

Upgrade to a fixed version: Orckestra C1-CMS-Foundation 6.13. Check the vendor advisory for mitigations.

References

• https://github.com/Orckestra/C1-CMS-Foundation/pull/814
• https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13
• https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j
• https://github.com/Orckestra/C1-CMS-Foundation/pull/814
• https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13
• https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j

Get alerted when CVE-2022-39256 or the next vulnerability affects your stack