fix: accept no classes for unserialize()

Author: kenjis

system/Entity/Cast/ArrayCast.php

@@ -26,7 +26,7 @@ public static function fromDatabase($value, array $params = []): array
         }
 
         if ((strpos($value, 'a:') === 0 || strpos($value, 's:') === 0)) {
-            $value = unserialize($value);
+            $value = unserialize($value, ['allowed_classes' => false]);
         }
 
         return (array) $value;