EUVD-2025-17483CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Petito allows PHP Local File Inclusion. This issue affects Petito: from n/a through 1.6.2.
Analysis
PHP Local File Inclusion (LFI) vulnerability in BZOTheme Petito versions up to 1.6.2 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability exploits improper control of filename parameters in PHP include/require statements (CWE-98), enabling attackers to read sensitive files, execute code, or compromise server integrity with a CVSS score of 8.1 (High). While no public exploit code or KEV/EPSS data are confirmed in standard databases, the high CVSS and network accessibility make this a significant priority for affected organizations.
Technical Context
This vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical weakness in PHP applications that fail to validate or sanitize user input before passing it to include(), require(), include_once(), or require_once() functions. BZOTheme Petito (a WordPress theme or PHP-based CMS component, based on naming conventions) contains an unvalidated parameter that allows an attacker to manipulate file paths. Rather than true Remote File Inclusion (RFI), this is specifically a Local File Inclusion (LFI) vulnerability, meaning attackers can only access files already present on the target server's filesystem. Attackers can traverse directory structures using path traversal sequences (e.g., '../../../etc/passwd') or reference log files, configuration files, or cached session data to extract sensitive information or achieve code execution via uploaded files or log poisoning techniques. Affected CPE would be: cpe:2.7:a:bzotheme:petito:*:*:*:*:*:*:*:* (versions <= 1.6.2).
Affected Products
BZOTheme Petito versions from an unspecified baseline through 1.6.2 (all versions <= 1.6.2). The vendor is BZOTheme. CPE identifier: cpe:2.7:a:bzotheme:petito:*:*:*:*:*:*:*:* with version constraint <= 1.6.2. Specific affected versions include: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.6.0, 1.6.1, and 1.6.2. Petito is likely a WordPress theme or PHP-based template system used for website theming or content management. Organizations running WordPress installations with this theme or any PHP-based system using Petito as a component should audit their deployment immediately.
Remediation
Immediate actions: (1) Upgrade BZOTheme Petito to version 1.6.3 or later (patch version not explicitly confirmed in available data, but assume next available release post-1.6.2 addresses this). (2) Contact BZOTheme directly for security advisory and patch availability if version 1.6.3+ is not yet released. (3) Temporary mitigations pending patch: Implement Web Application Firewall (WAF) rules to block common LFI payloads (e.g., '../', '..\', 'file://', 'php://filter'); restrict file permissions on sensitive server files (/etc/passwd, config files); disable PHP's allow_url_include directive in php.ini; use suhosin or similar hardening extensions. (4) Code-level fix (if vendor patching is delayed): Sanitize and validate all user inputs passed to include/require statements using a whitelist of allowed files or a robust path canonicalization function (e.g., realpath() with boundary checks). (5) Monitor access logs for LFI exploitation attempts (patterns like '%2e%2e', '....', or suspicious file path requests).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today