Quick.CMS breaks at the transport layer, not at the login screen. If admin-panel traffic stays on plaintext HTTP, an on-path attacker can change the serialized data in transit and turn a normal admin session into code execution on the server.
CERT Polska says the flaw is CVE-2026-11860 in OpenSolution Quick.CMS. The issue is triggered when an administrator opens the admin panel, and the v6.8 patch released on 14.05.2026 limits the communication to HTTPS. Without that fix, standard checks for bad uploads or stolen passwords miss the real problem: the payload is being altered before the server ever sees it.
Enforcing HTTPS removes the immediate exploit path, but any deployment still carrying sensitive state over unprotected HTTP keeps that same trust gap open.