fix: prevent PHP Object Injection in Entity ArrayCast

system/Entity/Cast/ArrayCast.php

@@ -18,7 +18,7 @@ class ArrayCast extends BaseCast
     public static function get($value, array $params = []): array
     {
         if (is_string($value) && (str_starts_with($value, 'a:') || str_starts_with($value, 's:'))) {
-            $value = unserialize($value);
+            $value = unserialize($value, ['allowed_classes' => false]);
         }
 
         return (array) $value;

tests/system/Entity/Cast/ArrayCastTest.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * This file is part of CodeIgniter 4 framework.
+ *
+ * (c) CodeIgniter Foundation <admin@codeigniter.com>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace CodeIgniter\Entity\Cast;
+
+use CodeIgniter\Test\CIUnitTestCase;
+use PHPUnit\Framework\Attributes\Group;
+use stdClass;
+
+/**
+ * @internal
+ */
+#[Group('Others')]
+final class ArrayCastTest extends CIUnitTestCase
+{
+    public function testGetPreventsObjectInjection(): void
+    {
+        $payload = serialize([new stdClass()]);
+
+        $result = ArrayCast::get($payload);
+
+        $this->assertInstanceOf('__PHP_Incomplete_Class', $result[0]);
+    }
+}