Magnolia (versions <=6.2.3) has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files.
Remote Code Execution has been achieved using this vulnerability.

The vendor's disclosure and fix for this vulnerability can be found here.

This vulnerability requires:

• Valid user credentials

More details and the exploitation process can be found in this PDF.