What is the CVSS score of CVE-2025-11023?

CVE-2025-11023 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of AcBakImzala are affected by CVE-2025-11023?

ArkSigner AcBakImzala versions prior to 5.1.4 contain a critical remote file inclusion vulnerability allowing unauthenticated attackers to execute arbitrary code on affected systems.

How to fix or mitigate CVE-2025-11023?

24 hours: Inventory all systems running ArkSigner AcBakImzala and document current versions; immediately restrict network access to affected systems from untrusted networks or move systems to isolated network segments. 7 days: Monitor vendor security advisories for release of patched versions; implement web application firewall rules to detect and block file inclusion attack patterns (PHP wrappers, path traversal). 30 days: Upon vendor patch release, deploy patched version to test environment, validate functionality and security improvements, then roll out to production systems across organization.

AcBakImzala CVE-2025-11023

CRITICAL

PHP Remote File Inclusion (CWE-98)

2025-10-23 iletisim@usom.gov.tr

PHP Information Disclosure LFI

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 20:30 vuln.today

DescriptionCVE.org

Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion.

This issue affects AcBakImzala: before v5.1.4.

AnalysisAI

Remote file inclusion in ArkSigner AcBakImzala versions before 5.1.4 allows unauthenticated attackers to coerce the PHP application into including attacker-controlled files, resulting in local file inclusion and potential remote code execution. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

AcBakImzala is a PHP-based signing/document application from ArkSigner Software and Hardware Inc., a Turkish vendor. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly referred to as PHP Remote/Local File Inclusion. This class of flaw occurs when user-controllable input flows into PHP's include, include_once, require, or require_once statements without sufficient validation, allowing an attacker to redirect the include target to an arbitrary file. Although classified as PHP RFI in the title, the description specifies the resulting condition is Local File Inclusion, meaning the included path resolves to files already accessible on the server; depending on PHP configuration (e.g., allow_url_include) and writable upload paths, LFI can escalate to arbitrary code execution via log poisoning, session files, or uploaded content.

Affected ProductsAI

ArkSigner Software and Hardware Inc. AcBakImzala at all versions prior to 5.1.4 is affected; version 5.1.4 and later are the fixed releases. No CPE entries were provided in the input data, and no vendor-hosted advisory URL was supplied - the only references are the Turkish national CERT (USOM) bulletins at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0356 and https://www.usom.gov.tr/bildirim/tr-25-0356, which should be consulted for the authoritative affected-version statement and any deployment-specific notes.

RemediationAI

Upgrade AcBakImzala to version 5.1.4 or later, which the advisory identifies as the fixed release; consult the USOM bulletins at https://www.usom.gov.tr/bildirim/tr-25-0356 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0356 for vendor-coordinated guidance. If immediate patching is not possible, restrict network reachability of the AcBakImzala web interface to trusted internal networks or VPN-only access to remove the unauthenticated network attack vector, and place a WAF rule in front of the application to block requests containing path-traversal sequences (../, ..\, %2e%2e) or absolute paths/URL schemes in query parameters that feed include statements - note this blocks only known attack shapes and may produce false positives against legitimate file-name parameters. As PHP-level hardening, set allow_url_include=Off and allow_url_fopen=Off in php.ini to neutralize remote URL inclusion, and configure open_basedir to confine includes to the application directory, accepting that these changes may break legitimate functionality and require regression testing. Monitor web and PHP error logs for anomalous include paths until the upgrade is deployed.