What is the CVSS score of CVE-2025-49251?

CVE-2025-49251 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49251?

A high-severity PHP file inclusion vulnerability in thembay Fana (versions through 1.1.28) allows attackers to read sensitive files from affected systems, potentially exposing credentials,…

How to fix or mitigate CVE-2025-49251?

Within 24 hours: Inventory all systems running thembay Fana and identify internet-facing instances; implement WAF rules to block suspicious file inclusion patterns. Within 7 days: Disable the Fana component if not operationally critical; segment affected systems from sensitive networks and restrict access to trusted IPs only. Within 30 days: Upgrade to patched version when available; if unavailable, evaluate replacement solutions or maintain strict network isolation with enhanced monitoring.

PHP CVE-2025-49251

EUVD-2025-18533 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18533

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana allows PHP Local File Inclusion. This issue affects Fana: from n/a through 1.1.28.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in thembay Fana versions through 1.1.28 that allows unauthenticated remote attackers to include and execute arbitrary files through improper control of filename parameters in PHP include/require statements. The high CVSS score of 8.1 reflects the potential for confidentiality, integrity, and availability impact, though the 'H' attack complexity suggests exploitation requires specific conditions or knowledge of the application architecture. No publicly confirmed KEV or widespread active exploitation is documented, but the 2025 CVE date indicates this is a recently disclosed vulnerability requiring immediate attention from Fana users.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of defects where user-controlled input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. In thembay Fana (a PHP-based application/theme/plugin), an attacker can manipulate filename parameters to point to arbitrary local files on the server filesystem. Unlike Remote File Inclusion (RFI), LFI is constrained to files accessible to the web server process, but can still lead to code execution through techniques such as: log file inclusion (if logs contain attacker-controlled content), session file inclusion, or temporary file inclusion. The affected product identifier would be: cpe:2.3:a:thembay:fana:*:*:*:*:*:*:*:* (versions up to 1.1.28). This vulnerability is particularly dangerous in shared hosting environments where attackers can chain LFI with other attack vectors (e.g., mail header injection to write to log files).