Barn2 Plugins Document Library Pro critical deserialization vulnerability CVE-2026-122662

Barn2 Plugins’ Document Library Pro plugin contains a deserialization of untrusted data vulnerability (CVE‑2026‑122662) that allows object injection and is rated a 9.8 critical CVSS score. The flaw affects all releases prior to 4.2.2, and the vendor has not yet issued a formal advisory, but the NVD record lists the fix in 4.2.2. Users of the plugin should immediately upgrade to version 4.2.2 or later to eliminate the risk of remote code execution. This update is the only known mitigation, and no active exploitation has been reported yet, so prompt patching is recommended to maintain security posture. For more details, see the NVD entry here: CVE‑2026‑122662. The vulnerability arises from improper handling of serialized objects, enabling attackers to inject arbitrary PHP objects that can execute code on the server. Barn2 has released version 4.2.2 to address this issue, and users should apply the patch as soon as possible. Monitoring for exploitation attempts is advised, but no active exploits have been observed to date.