【Vulnerability Alert】Huanji Technology | OAKlouds - Insecure Deserialization

• Subject:【Vulnerability Alert】Huanji Technology | OAKlouds - Insecure Deserialization

• Description:
  • Forwarded TWCERT/CC (Taiwan Computer Emergency Response Team and Coordination Center) Security Alert TWCERTCC-200-202610-00000006
  • The Huanji Technology product OAKlouds has 2 security vulnerabilities, of which 1 is a critical security vulnerability:
  • 【Huanji Technology | OAKlouds - Insecure Deserialization】(CVE-2026-93467, CVSS: 9.8) An unauthenticated remote attacker can execute arbitrary code on the server by sending malicious serialized content.
  • 【Huanji Technology | OAKlouds - Arbitrary File Read】(CVE-2026-93468, CVSS: 7.5) An unauthenticated remote attacker can read arbitrary system files by exploiting Relative Path Traversal.
• Affected Platforms:
  • 【CVE-2026-93467】 OAKlouds-custom_page-2.0 versions prior to 26 (exclusive), OAKlouds-custom_page-3.0 versions prior to 26 (exclusive), OAKlouds-custom_page-4.0 versions prior to 26 (exclusive)
  • 【CVE-2026-93468】 OAKlouds-bulletin_v3-2.0 versions prior to 107, OAKlouds-bulletin_v3-3.0 versions prior to 107
• Recommended Actions:
  • 【CVE-2026-93467】 Update OAKlouds-custom_page-2.0 to version 26 (inclusive) or later, update OAKlouds-custom_page-3.0 to version 26 (inclusive) or later, update OAKlouds-custom_page-4.0 to version 26 (inclusive) or later
  • 【CVE-2026-93468】 Update to OAKlouds-bulletin_v3-2.0-107 (inclusive) or later versions, update to OAKlouds-bulletin_v3-3.0-107 (inclusive) or later versions
• References:
  1. https://www.twcert.org.tw/tw/cp-132-11210-11cb0-1.html

Computer and Communication Center
Network System Division