What is the CVSS score of CVE-2025-49259?

CVE-2025-49259 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49259?

A high-severity local file inclusion vulnerability in thembay Hara (versions up to 1.2.10) allows attackers to read sensitive files from affected servers, potentially exposing credentials,…

How to fix or mitigate CVE-2025-49259?

Within 24 hours: Inventory all systems running thembay Hara and assess exposure; disable the plugin if not operationally critical. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns in requests to Hara; apply input validation and output encoding controls. Within 30 days: Either upgrade to a patched version when available, migrate to an alternative solution, or implement network segmentation to restrict Hara access to trusted networks only.

PHP CVE-2025-49259

EUVD-2025-18649 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP WordPress Information Disclosure LFI Wordpress Theme

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18649

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara allows PHP Local File Inclusion. This issue affects Hara: from n/a through 1.2.10.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in thembay Hara that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. Affected versions range from an unspecified baseline through version 1.2.10. While the CVSS score of 8.1 is elevated, the attack complexity is rated 'High,' suggesting real-world exploitation requires specific environmental conditions or timing.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP code inclusion flaw where user-supplied input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. thembay Hara, a PHP-based application/theme, fails to properly validate or sanitize filename parameters before passing them to file inclusion functions. This differs from Remote File Inclusion (RFI) by restricting exploitation to files already present on the server filesystem, though the attacker can still achieve arbitrary code execution by including files such as web server logs, uploaded files, or PHP wrappers (e.g., php://filter). The vulnerability affects thembay Hara versions up to and including 1.2.10; the lack of a specified 'from' version suggests the flaw may have existed since early releases.