diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad5b3200..f1e2882a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Fix crash on mapping/injection screens (`Safe\unserialize` not shipped by GLPI core yet)
+
 ## [2.15.9] - 2026-08-04
 
 ### Fixed
diff --git a/ajax/injection.php b/ajax/injection.php
index 3725c856..4ad9be62 100644
--- a/ajax/injection.php
+++ b/ajax/injection.php
@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "injection.php")) {
     header("Content-Type: text/html; charset=UTF-8");
@@ -37,5 +35,5 @@
 }
 
 Session::checkCentralAccess();
-$model = unserialize($_SESSION['datainjection']['currentmodel']);
+$model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showInjectionForm($model, $_SESSION['glpiactive_entity']);
diff --git a/ajax/results.php b/ajax/results.php
index 704c30d4..c08ed9a9 100644
--- a/ajax/results.php
+++ b/ajax/results.php
@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "results.php")) {
     header("Content-Type: text/html; charset=UTF-8");
@@ -37,5 +35,5 @@
 }
 
 Session::checkCentralAccess();
-$model = unserialize($_SESSION['datainjection']['currentmodel']);
+$model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showResultsForm($model);
diff --git a/front/clientinjection.form.php b/front/clientinjection.form.php
index 5dbf9789..303e3404 100644
--- a/front/clientinjection.form.php
+++ b/front/clientinjection.form.php
@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 Session::checkRight("plugin_datainjection_use", READ);
 
 Html::header(
@@ -41,7 +39,7 @@
 );
 
 if (isset($_SESSION['datainjection']['go'])) {
-    $model = unserialize($_SESSION['datainjection']['currentmodel']);
+    $model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
     PluginDatainjectionClientInjection::showInjectionForm($model, $_SESSION['glpiactive_entity']);
 } elseif (isset($_POST['upload'])) {
     $model = new PluginDatainjectionModel();
diff --git a/inc/clientinjection.class.php b/inc/clientinjection.class.php
index 561604a8..ca94ea53 100644
--- a/inc/clientinjection.class.php
+++ b/inc/clientinjection.class.php
@@ -41,7 +41,6 @@
 use function Safe\json_encode;
 use function Safe\readfile;
 use function Safe\unlink;
-use function Safe\unserialize;
 
 class PluginDatainjectionClientInjection
 {
@@ -195,7 +194,7 @@ public static function processBatch(int $offset, int $batch_size): array
 
         Profile::getCurrent()->disable();
 
-        $model = unserialize($_SESSION['datainjection']['currentmodel']);
+        $model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
         $model->loadSpecificModel();
         $entities_id = $_SESSION['glpiactive_entity'];
         $lines_json  = PluginDatainjectionSession::getParam('injection_lines');
@@ -328,7 +327,7 @@ public static function exportErrorsInCSV()
         self::stripslashes_array($error_lines);
 
         if (!empty($error_lines)) {
-            $model = unserialize(PluginDatainjectionSession::getParam('currentmodel'));
+            $model = PluginDatainjectionSession::unserialize(PluginDatainjectionSession::getParam('currentmodel'));
             $file  = PLUGIN_DATAINJECTION_UPLOAD_DIR . PluginDatainjectionSession::getParam('file_name');
 
             $mappings = $model->getMappings();
diff --git a/inc/mapping.class.php b/inc/mapping.class.php
index 19d87f47..d92d314a 100644
--- a/inc/mapping.class.php
+++ b/inc/mapping.class.php
@@ -32,7 +32,6 @@
 
 use function Safe\ob_get_clean;
 use function Safe\ob_start;
-use function Safe\unserialize;
 
 class PluginDatainjectionMapping extends CommonDBTM
 {
@@ -100,7 +99,7 @@ public function getItemtype()
     public static function showFormMappings(PluginDatainjectionModel $model)
     {
         $canedit = $model->can($model->fields['id'], UPDATE);
-        $lines = isset($_SESSION['datainjection']['lines']) ? unserialize($_SESSION['datainjection']['lines']) : [];
+        $lines = isset($_SESSION['datainjection']['lines']) ? PluginDatainjectionSession::unserialize($_SESSION['datainjection']['lines']) : [];
 
         $show_preview = isset($_SESSION['datainjection']['lines']) && !empty($lines);
         $preview_url = '';
diff --git a/inc/model.class.php b/inc/model.class.php
index 7c6f790a..112f72f7 100644
--- a/inc/model.class.php
+++ b/inc/model.class.php
@@ -33,7 +33,6 @@
 use function Safe\json_decode;
 use function Safe\realpath;
 use function Safe\tempnam;
-use function Safe\unserialize;
 
 /**
  * -------------------------------------------------------------------------
@@ -1321,7 +1320,7 @@ public static function showPreviewMappings($models_id)
 
         echo "<table class='tab_cadre_fixe'>";
         if (isset($_SESSION['datainjection']['lines'])) {
-            $injectionData = unserialize($_SESSION['datainjection']['lines']);
+            $injectionData = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['lines']);
             $lines         = $injectionData->getData();
             $nblines       = $_SESSION['datainjection']['nblines'];
             $model         = self::getInstanceByModelID($models_id);
diff --git a/inc/session.class.php b/inc/session.class.php
index 8a5bd2dd..ea89a770 100644
--- a/inc/session.class.php
+++ b/inc/session.class.php
@@ -34,6 +34,24 @@
 
 class PluginDatainjectionSession
 {
+    /**
+    * Unserialize a value, using Safe\unserialize() when available
+    * (not shipped by GLPI core yet, see thecodingmachine/safe >= 3.4.0)
+    *
+    * @param string $data  the serialized value
+    *
+    * @return mixed the unserialized value
+   **/
+    public static function unserialize(string $data)
+    {
+        if (function_exists('Safe\unserialize')) {
+            return \Safe\unserialize($data);
+        }
+        // @phpstan-ignore theCodingMachineSafe.function
+        return unserialize($data);
+    }
+
+
     /**
     * Get a parameter from the HTTP session
     *