Executive brief
Rox, the open-source software powering the BeWelcome travel community, contains a critical security flaw in how it handles user data. An attacker with a standard user account can exploit this to run unauthorized commands on the server or modify sensitive files. This could lead to a complete takeover of the website, potentially exposing user data or disrupting the service.
Technical details
A PHP object injection vulnerability exists in Rox due to the use of the insecure unserialize() function on untrusted user input. Specifically, the vulnerability is present in the 'formkit_memory_recovery' POST parameter within \RoxPostHandler::getCallbackAction and the 'bwRemember' cookie processed by \RoxModelBase::getMemoryCookie. While the affected routes typically require authentication, an attacker with basic user privileges can leverage existing gadget chains in Rox and its bundled libraries (such as Monolog, Symfony, and Doctrine) to achieve remote code execution (RCE) or arbitrary file writes. The issue was addressed in June 2025 by remediating the deserialization logic.
Affected products
- BeWelcome Rox commit f09be94 to commit c60bf04
Timeline
- 2025-01-03: other: Vulnerability introduced in commit f09be94
- 2025-01-27: disclosed: Researcher contacted maintainers via support ticket
- 2025-06-16: patched: Fix committed (c60bf04)
- 2025-10-23: other: Maintainers confirmed fix deployed to production
- 2025-10-27: advisory: Public disclosure and CVE assignment