refactor: restrict object deserialization in selected unserialize() calls#10254

Open

XananasX7 wants to merge 2 commits into

codeigniter4:developfrom

XananasX7:security/cache-unserialize-allowed-classes

Commits on May 31, 2026

Security: add allowed_classes to unserialize() in cache and entity cast to prevent PHP Object Injection
XananasX7
committed
fix(security): add tests and changelog for allowed_classes unserialize fix
XananasX7
committed