Posting Date: 2026/10/13

【Vulnerability Alert】Huanji Technology | OAKlouds - Insecure Deserialization

  • Subject:【Vulnerability Alert】Huanji Technology | OAKlouds - Insecure Deserialization


  • Description:
    • Forwarded TWCERT/CC (Taiwan Computer Emergency Response Team and Coordination Center) Security Alert TWCERTCC-200-202610-00000006
    • The Huanji Technology product OAKlouds has 2 security vulnerabilities, of which 1 is a critical security vulnerability:
    • 【Huanji Technology | OAKlouds - Insecure Deserialization】(CVE-2026-93467, CVSS: 9.8) An unauthenticated remote attacker can execute arbitrary code on the server by sending malicious serialized content.
    • 【Huanji Technology | OAKlouds - Arbitrary File Read】(CVE-2026-93468, CVSS: 7.5) An unauthenticated remote attacker can read arbitrary system files by exploiting Relative Path Traversal.
  • Affected Platforms:
    • 【CVE-2026-93467】 OAKlouds-custom_page-2.0 versions prior to 26 (exclusive), OAKlouds-custom_page-3.0 versions prior to 26 (exclusive), OAKlouds-custom_page-4.0 versions prior to 26 (exclusive)
    • 【CVE-2026-93468】 OAKlouds-bulletin_v3-2.0 versions prior to 107, OAKlouds-bulletin_v3-3.0 versions prior to 107
  • Recommended Actions:
    • 【CVE-2026-93467】 Update OAKlouds-custom_page-2.0 to version 26 (inclusive) or later, update OAKlouds-custom_page-3.0 to version 26 (inclusive) or later, update OAKlouds-custom_page-4.0 to version 26 (inclusive) or later
    • 【CVE-2026-93468】 Update to OAKlouds-bulletin_v3-2.0-107 (inclusive) or later versions, update to OAKlouds-bulletin_v3-3.0-107 (inclusive) or later versions
  • References:
    1. https://www.twcert.org.tw/tw/cp-132-11210-11cb0-1.html

Computer and Communication Center
Network System Division