What is the CVSS score of CVE-2025-49261?

CVE-2025-49261 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49261?

A high-severity PHP file inclusion vulnerability (CVE-2025-49261) affects Diza versions through 1.3.8, allowing attackers to access sensitive local files on affected systems.

How to fix or mitigate CVE-2025-49261?

Within 24 hours: Identify all systems running Diza versions 1.3.8 and below; isolate affected instances from untrusted networks if possible. Within 7 days: Implement WAF rules to block file inclusion attempts targeting common sensitive paths (/etc/passwd, config files); apply input validation and disable dynamic file includes if the feature is non-essential. Within 30 days: Upgrade to Diza version 1.3.9 or later once available; if no patch emerges, evaluate alternative solutions or establish a vendor accountability timeline.

PHP CVE-2025-49261

EUVD-2025-28291 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28291

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza allows PHP Local File Inclusion. This issue affects Diza: from n/a through 1.3.8.

AnalysisAI

PHP Local/Remote File Inclusion (LFI/RFI) vulnerability in thembay Diza affecting versions through 1.3.8, stemming from improper control of filenames in include/require statements (CWE-98). An unauthenticated network attacker can exploit this with high complexity to achieve arbitrary file inclusion, leading to information disclosure, code execution, or system compromise. The high CVSS score of 8.1 reflects the severity of potential impacts (confidentiality, integrity, and availability), though real-world exploitability depends on PHP configuration and the specific include/require patterns in affected code.

Technical ContextAI

This vulnerability exploits inadequate input validation on file paths passed to PHP's include(), require(), include_once(), or require_once() functions—core language constructs used for dynamic file loading. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) identifies the root cause: the application fails to sanitize or whitelist user-supplied input before using it in file inclusion statements. The vulnerability can manifest as Local File Inclusion (LFI)—reading arbitrary local files like /etc/passwd or configuration files—or Remote File Inclusion (RFI)—if allow_url_include is enabled in php.ini, allowing inclusion of attacker-controlled remote PHP files for code execution. thembay Diza is a WordPress theme/plugin ecosystem product; the specific affected CPE would be cpe:2.3:a:thembay:diza:*:*:*:*:*:*:*:* with versions ≤1.3.8. The vulnerability likely resides in template loading, asset inclusion, or theme customization routines that construct file paths from user input (GET/POST parameters, cookies, or headers) without proper validation.

RemediationAI

patch_availability: Upgrade thembay Diza to version 1.3.9 or later (specific patch version should be confirmed via thembay official release notes/security advisory); immediate_steps: ['Identify all WordPress installations using thembay Diza ≤1.3.8 via dashboard plugins/themes page or server file audit', 'Apply available security update to version 1.3.9+ immediately', 'If patch is unavailable, disable the affected plugin/theme and switch to an alternative until patched']; workarounds: ['Implement Web Application Firewall (WAF) rules to block suspicious file inclusion attempts (pattern matching for ../, etc.)', 'Restrict HTTP methods and input parameters that feed into include/require statements', "Ensure allow_url_include and allow_url_fopen are set to 'Off' in php.ini to mitigate RFI", "Monitor PHP error logs for 'Failed opening required' messages indicating exploitation attempts", 'Apply principle of least privilege to file system permissions on WordPress directories']; vendor_advisory: Contact thembay directly or monitor https://github.com/thembay/diza or official support channels for patch release; confirm advisory URL from official sources