EUVD-2025-17665CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a before 3.10.0.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in LoftOcean TinySalt versions before 3.10.0, caused by improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this network-accessible vulnerability with moderate complexity to read arbitrary files, execute code, and potentially achieve remote code execution, though exploitation requires specific conditions due to high attack complexity. The vulnerability has not been confirmed as actively exploited in the wild (KEV status unknown), but represents a critical risk for exposed TinySalt installations.
Technical ContextAI
This vulnerability exploits improper input validation in PHP file inclusion mechanisms, specifically the include() or require() language constructs. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) occurs when user-supplied input is passed directly to these functions without adequate sanitization. In TinySalt (CPE: likely cpe:2.3:a:loftocean:tinysalt), the affected versions (before 3.10.0) allow attackers to manipulate filename parameters to include arbitrary local files from the server filesystem. Unlike Remote File Inclusion (RFI), this LFI variant is restricted to local filesystem access, but can still be leveraged to read sensitive files (configuration files, source code, /etc/passwd-equivalent), or combined with file upload/log poisoning techniques to achieve RCE. The high CVSS attack complexity (AC:H) suggests certain preconditions are necessary, such as specific PHP configuration states (allow_url_include off, stream wrappers available, or predictable file paths).
RemediationAI
Immediate actions: (1) Upgrade TinySalt to version 3.10.0 or later—this is the definitive fix. (2) Temporary mitigations if upgrade is not immediately possible: Restrict network access to TinySalt via firewall/WAF rules (whitelist only authorized IPs), disable PHP file inclusion functions via php.ini (disable_functions=include,require,include_once,require_once if application permits), implement strict input validation on any filename parameters, apply chroot/open_basedir PHP directives to limit filesystem access to safe directories. (3) Detection: Review web server logs for suspicious include/require parameter patterns (path traversal sequences like ../, etc., or unusual file paths). (4) Validation: After patching to 3.10.0+, verify the patch is applied by checking version strings or file hashes. Consult LoftOcean's official advisory and GitHub repository for detailed patch notes and deployment instructions.
Share
External POC / Exploit Code
Leaving vuln.today