What is the CVSS score of CVE-2025-49252?

CVE-2025-49252 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49252?

A high-severity local file inclusion vulnerability in Besa (versions through 2.3.8) could allow attackers to read sensitive files from affected systems, potentially exposing credentials,…

How to fix or mitigate CVE-2025-49252?

Within 24 hours: Inventory all systems running Besa and assess exposure; disable Besa if non-critical to operations. Within 7 days: Implement Web Application Firewall (WAF) rules to filter malicious file inclusion patterns and restrict PHP file access; apply input validation controls. Within 30 days: Monitor vendor communications for patch availability; plan immediate deployment upon release; consider alternative plugins if patch timeline is unacceptable.

PHP CVE-2025-49252

EUVD-2025-18532 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18532

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa allows PHP Local File Inclusion. This issue affects Besa: from n/a through 2.3.8.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in thembay Besa versions through 2.3.8, stemming from improper control of filenames in include/require statements (CWE-98). An unauthenticated remote attacker can exploit this via a network vector with high complexity to achieve arbitrary file read/write capabilities, potentially leading to remote code execution. The high CVSS score of 8.1 reflects the severity of the confidentiality, integrity, and availability impact, though real-world exploitation requires specific conditions given the AC:H rating.

Technical ContextAI

This vulnerability exploits a weakness in PHP's file inclusion mechanisms where user-supplied input is not properly validated before being passed to include(), require(), include_once(), or require_once() statements. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP) is a well-documented class of vulnerabilities where an attacker manipulates the filename parameter to include arbitrary files from the local filesystem or, in some configurations, remote resources. The thembay Besa product, affected from inception through version 2.3.8, appears to use dynamic file inclusion without proper sanitization or allowlisting. Attack vectors typically involve manipulating GET/POST parameters, HTTP headers, or cookie values that feed into include statements. The high complexity rating (AC:H) suggests exploitation requires specific conditions: unusual server configurations (e.g., allow_url_include enabled), specific PHP wrappers (php://filter, php://input), or file upload capabilities to place exploit payloads.

RemediationAI

Immediate actions: (1) Upgrade thembay Besa to version 2.3.9 or later once available (check thembay's official release channels and security advisories). (2) If immediate patching is impossible, implement input validation: whitelist allowed filenames/paths, reject path traversal sequences (.., /, \), and use basename() to strip directory components. (3) Disable dangerous PHP settings: set allow_url_include=Off and allow_url_fopen=Off in php.ini. (4) Disable PHP wrappers if not required: wrap file inclusion calls with is_file() and realpath() checks to ensure included files exist within an expected directory. (5) Use PHP's open_basedir directive to restrict inclusion to a specific directory tree. (6) Implement Web Application Firewall (WAF) rules to detect and block LFI payloads (e.g., patterns containing ../, etc/passwd, php://). (7) Monitor server logs for suspicious include/require patterns and file access anomalies. For vendor: thembay should publish a security advisory with patched version information (expected: 2.3.9+) and recommend users upgrade. Long-term: adopt code review practices to identify all dynamic file inclusion and apply CWE-98 hardening patterns.