External risk intelligence

SIGB PMB Arbitrary Code Execution via Unserialization

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-61168

The vulnerability exists within a REST API component (cms_rest.php) of a web-based content management system. Such components are commonly deployed as web-facing endpoints to facilitate communication, making them likely to be reachable from the internet in typical deployments.

Deserialization

Sigb Pmb

8.0.1.14

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a component of SIGB PMB software, which could allow attackers to execute arbitrary code. The issue stems from improper handling of serialized data, potentially enabling unauthorized code execution by exploiting a file handling mechanism. This could have significant implications for the security and integrity of systems utilizing this software.

Code execution via file handling flaw.
External access means widespread potential exposure.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `cms_rest.php` component. This component is exposed via a network interface, meaning an attacker does not need any prior access or authentication to reach it. The vulnerability lies in the component's handling of serialized data, which can be manipulated to execute arbitrary code.

Network access required.
Triggered by unserializing arbitrary file.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker could execute arbitrary code by exploiting a flaw in the `cms_rest.php` component. This could occur when the system unserializes arbitrary files, potentially leading to unauthorized system modifications or data compromise.

Arbitrary code execution and system control.
Unserializing a crafted file via network.
Unauthorized data access and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, application owners and platform teams should collaborate. The immediate first step is to identify all instances of the affected technology, assess their reachability and business criticality, and locate the accountable owner for each. Subsequently, a risk-based remediation plan can be developed, potentially involving vendor coordination or temporary mitigation strategies.

Identify application owners and platform teams.
Verify asset reachability and business criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SIGB PMB and what is it used for?

SIGB PMB is a library management software used to organize and provide access to information collections. It acts as an integrated library system, helping institutions manage cataloging, circulation, and digital resources.

What is the vulnerability in CVE-2025-61168?

This vulnerability is classified as CWE-502, which involves insecure deserialization. In plain terms, the software blindly trusts and processes data structures from external sources. Because it fails to validate this data properly before converting it back into usable code, an attacker can trick the system into running malicious instructions.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted request to the cms_rest.php component. The vulnerability is specifically activated when the software unserializes a malicious file. It is not triggered by standard, legitimate interactions that do not involve malformed or attacker-controlled serialized data.

Do I need to worry if my SIGB PMB instance is internal?

Halo Surface Signal notes that this vulnerability resides in a REST API component typically deployed as a web-facing endpoint. While internet-facing instances face the highest risk, any system reachable over a network—whether internal or external—could theoretically be targeted if an attacker gains access to that network segment.

How should I respond to CVE-2025-61168?

Start by identifying every instance of SIGB PMB running in your environment. Once located, verify which systems are reachable over the network and determine who is responsible for managing them. Prioritize these assets based on their business criticality to coordinate a remediation plan with your technical teams.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.