What is the CVSS score of CVE-2025-49454?

CVE-2025-49454 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49454?

LoftOcean TinySalt versions prior to 3.10.0 contain a local file inclusion vulnerability (CVE-2025-49454, CVSS 8.1) that allows unauthenticated remote attackers to read arbitrary files and…. A patch is available.

How to fix or mitigate CVE-2025-49454?

Within 24 hours: inventory all TinySalt installations and document version numbers and network exposure; isolate any TinySalt instances accessible from untrusted networks. Within 7 days: upgrade all TinySalt deployments to version 3.10.0 or later per vendor patch release. Within 30 days: conduct file access and application logs review on affected systems for indicators of exploitation; verify remediation across all endpoints.

PHP CVE-2025-49454

EUVD-2025-17665 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-10 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 10:22 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:42 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.10.0

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17665

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 13:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a before 3.10.0.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in LoftOcean TinySalt versions before 3.10.0, caused by improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this network-accessible vulnerability with moderate complexity to read arbitrary files, execute code, and potentially achieve remote code execution, though exploitation requires specific conditions due to high attack complexity. The vulnerability has not been confirmed as actively exploited in the wild (KEV status unknown), but represents a critical risk for exposed TinySalt installations.

Technical ContextAI

This vulnerability exploits improper input validation in PHP file inclusion mechanisms, specifically the include() or require() language constructs. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) occurs when user-supplied input is passed directly to these functions without adequate sanitization. In TinySalt (CPE: likely cpe:2.3:a:loftocean:tinysalt), the affected versions (before 3.10.0) allow attackers to manipulate filename parameters to include arbitrary local files from the server filesystem. Unlike Remote File Inclusion (RFI), this LFI variant is restricted to local filesystem access, but can still be leveraged to read sensitive files (configuration files, source code, /etc/passwd-equivalent), or combined with file upload/log poisoning techniques to achieve RCE. The high CVSS attack complexity (AC:H) suggests certain preconditions are necessary, such as specific PHP configuration states (allow_url_include off, stream wrappers available, or predictable file paths).

RemediationAI

Immediate actions: (1) Upgrade TinySalt to version 3.10.0 or later—this is the definitive fix. (2) Temporary mitigations if upgrade is not immediately possible: Restrict network access to TinySalt via firewall/WAF rules (whitelist only authorized IPs), disable PHP file inclusion functions via php.ini (disable_functions=include,require,include_once,require_once if application permits), implement strict input validation on any filename parameters, apply chroot/open_basedir PHP directives to limit filesystem access to safe directories. (3) Detection: Review web server logs for suspicious include/require parameter patterns (path traversal sequences like ../, etc., or unusual file paths). (4) Validation: After patching to 3.10.0+, verify the patch is applied by checking version strings or file hashes. Consult LoftOcean's official advisory and GitHub repository for detailed patch notes and deployment instructions.