CVE-2020-29312

Critical · CVSS 9.8

Zend Framework — PHP object deserialization RCE (unserialize)

CVSS: 9.8; nvd
EPSS: 1.52%; 72th pct
KEV: No
Class: other; CWE-502

Description

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

Search profile — drives PoC discovery

Symbols unserializeZend\Stdlib\ArrayObjectZend\Mvc\ApplicationZend\Session\Container__wakeup__destructPOP chain

Keywords CVE-2020-29312Zend Framework unserialize RCEZend Framework deserialization exploitzendframework CVE-2020-29312 PoCZend Framework 3.1.3 RCEPHP unserialize Zend Framework gadget chainCWE-502 Zend Framework

Versions: <= 3.1.3 (disputed; framework deprecated, max real version is 2.x)

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T18:00:39.000Z · profiled 2026-07-05T18:30:39.000Z