What is the CVSS score of CVE-2025-32595?

CVE-2025-32595 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-32595?

A critical file inclusion vulnerability in Gavias Krowd (versions through 1.4.1) could allow attackers to access sensitive files on affected systems, potentially exposing confidential data or…

How to fix or mitigate CVE-2025-32595?

Within 24 hours: Identify all systems running Gavias Krowd and assess exposure scope; disable the Krowd plugin if non-critical or isolate affected systems from untrusted networks. Within 7 days: Implement WAF rules to block malicious file inclusion patterns; apply input validation and access controls; monitor logs for exploitation attempts. Within 30 days: Either upgrade to patched versions when available, migrate to alternative solutions, or maintain compensating controls; conduct security audit of affected systems for any unauthorized access.

PHP CVE-2025-32595

EUVD-2025-17510 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17510

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd allows PHP Local File Inclusion. This issue affects Krowd: from n/a through 1.4.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in Gavias Krowd versions up to 1.4.1 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), enabling attackers to read sensitive files or execute malicious code with high complexity but high impact including confidentiality, integrity, and availability compromise. No public exploit code or active exploitation reports are currently available in standard vulnerability databases, but the high CVSS score (8.1) and network-accessible attack vector indicate significant risk for unpatched installations.

Technical ContextAI

The vulnerability exists in the Gavias Krowd theme/plugin framework for PHP-based content management systems. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes the root cause: dynamic file inclusion where user-supplied input is passed directly to PHP include(), require(), include_once(), or require_once() functions without proper validation or sanitization. An attacker can manipulate filename parameters to include local files (LFI) by using path traversal sequences (e.g., '../../../etc/passwd') or PHP wrappers (php://filter/, php://input) to read sensitive configuration files, access source code, or achieve remote code execution if combined with file upload functionality or log injection techniques. The attack surface is the web-facing parameters of Krowd components that handle file inclusion logic.