CVE-2025-1186 is a medium severity deserialization flaw in dayrui XunRuiCMS up to version 4.6.4. The thumb argument in /Control/Api/Api.php reaches deserialization, and NVD scores it 6.3. I could not confirm a fixed version, so check the vendor's releases and limit access to the endpoint.
What's affected
The NVD record says dayrui XunRuiCMS up to and including version 4.6.4 is affected. The vulnerable code is in the file /Control/Api/Api.php, and the argument that matters is thumb.
The record says the attack can be started remotely and that an exploit has been disclosed to the public. The CVSS vector lists a low privilege requirement, so an attacker needs some kind of account, and low impact on confidentiality, integrity and availability.
On fixed versions: the record does not name one, and the references I could reach did not either. Check the vendor's release notes and the project's repository for anything newer than 4.6.4 before you decide.
How to check if you're exposed
- Find your XunRuiCMS installs. On a server you can search for the framework's directory layout, for example
find /var/www -name Api.php -path "*Control/Api*". - Read the installed version from the admin area or the version file of the application. Anything up to 4.6.4 is in scope.
- Check whether the CMS is reachable from the internet and whether public visitors can hold an account.
- Look at your web server logs for requests to the Api.php endpoint with an unusually long or unexpected thumb value, so you know whether anyone has been probing it.
What to do now
- Look for a version newer than 4.6.4 and upgrade if one exists. Test on a copy first.
- If no fix exists, restrict access to the /Control/Api/ path to the clients that need it, using your web server or a web application firewall.
- Remove unused accounts, and reduce who can sign in, since the attack needs low privileges.
- If you maintain code that handles serialized data, never pass user input to unserialize(). Use a data only format such as JSON, or restrict which classes may be restored.
- Keep a copy of your logs and file integrity records so you can look back if a fix appears later.
Why it matters
The weaknesses are CWE-502, deserialization of untrusted data, and CWE-20, improper input validation. Deserialization turns stored bytes back into live objects. If the input is attacker controlled, the objects it builds can trigger code the application already contains, which is why the class has a long history of serious bugs in PHP, Java and other platforms.
Here the score is medium because the vector requires a login and rates impact as low. That should not make it a low priority if your CMS accepts public sign ups. The NVD description says an exploit is public, and small projects often lack a fast fix path.
The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is deserialization dangerous?
Because it rebuilds objects from data. If an attacker controls the data, they may be able to make the application run code paths it was never meant to. The safe habit is not to deserialize untrusted input at all.
Is there a fixed release?
I could not confirm one. The NVD record gives no fixed version. Check the vendor's release notes.
Sources
Last reviewed: 19 October 2026.
