What is the CVSS score of CVE-2025-49508?

CVE-2025-49508 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49508?

CVE-2025-49508 is a critical PHP file inclusion vulnerability affecting LoftOcean CozyStay that could allow attackers to access sensitive files or execute malicious code on affected systems.. A patch is available.

How to fix or mitigate CVE-2025-49508?

Within 24 hours: Inventory all systems running CozyStay and isolate affected instances from untrusted networks where possible. Within 7 days: Implement Web Application Firewall (WAF) rules to block file inclusion attempts and apply input validation filters; disable any unnecessary file inclusion features in CozyStay configuration. Within 30 days: Monitor vendor security advisories daily for patch availability and establish a deployment plan; conduct code review of CozyStay implementation to identify risky file inclusion patterns; consider migration to alternative solutions if patch timeline extends beyond 60 days.

PHP CVE-2025-49508

EUVD-2025-18523 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.7.1

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18523

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay allows PHP Local File Inclusion. This issue affects CozyStay: from n/a through n/a.

AnalysisAI

PHP Local/Remote File Inclusion (LFI/RFI) vulnerability in LoftOcean CozyStay that allows unauthenticated remote attackers to include and execute arbitrary files through improper control of filename parameters in PHP include/require statements. The vulnerability affects CozyStay with a CVSS score of 8.1 (High severity), enabling attackers to read sensitive files, execute arbitrary code, or compromise system integrity without requiring user interaction or authentication.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-supplied input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. CozyStay, a property management/booking system by LoftOcean, fails to properly validate or sanitize filename parameters before using them in file inclusion statements. While classified as 'PHP Remote File Inclusion' in the CVE title, the description indicates Local File Inclusion (LFI) is the primary concern, though RFI may be possible if PHP wrappers (stream:// protocols) are enabled. The vulnerability bypasses critical security controls that should restrict includes to whitelisted paths or implement strict input validation.

RemediationAI

Immediate actions: (1) Contact LoftOcean for official security advisories and patch availability at https://loftocean.com or support channels; (2) Implement network segmentation to restrict direct internet access to CozyStay instances; (3) Deploy Web Application Firewall (WAF) rules to block common LFI payloads (e.g., regex patterns for '../', 'php://', 'file://', 'expect://' in request parameters); (4) Review and audit all include/require statements in CozyStay codebase for unsanitized user input. Long-term: Apply official patches from LoftOcean when released, upgrade to patched versions immediately. Mitigation: If patching is delayed, implement strict input validation using whitelisting (only allow expected filenames/directories) and disable PHP wrappers via php.ini (allow_url_include=Off, allow_url_fopen=Off).