CVE-2025-63950

An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The obj parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Potential Mitigations

• Make fields transient to protect them from deserialization.
• An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/586.html

References

• https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-2025-63950.md
• https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-pending-Deserialization.md