What is the CVSS score of CVE-2025-52708?

CVE-2025-52708 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-52708?

A local file inclusion vulnerability in HUSKY versions up to 1.3.7 could allow attackers to access sensitive files on affected systems, potentially exposing confidential data and enabling further…

How to fix or mitigate CVE-2025-52708?

Within 24 hours: Inventory all systems running HUSKY and isolate affected instances from untrusted networks; notify stakeholders of exposure status. Within 7 days: Implement Web Application Firewall (WAF) rules to block file inclusion attempts and restrict access to HUSKY administration interfaces to trusted IP ranges only. Within 30 days: Evaluate alternative solutions, plan migration strategy, or await vendor patch; conduct security assessment of potentially compromised systems.

PHP CVE-2025-52708

EUVD-2025-28451 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-20 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28451

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY allows PHP Local File Inclusion. This issue affects HUSKY: from n/a through 1.3.7.

AnalysisAI

CVE-2025-52708 is a PHP Local File Inclusion (LFI) vulnerability in RealMag777 HUSKY versions up to 1.3.7, stemming from improper control of filenames in include/require statements. An authenticated attacker with low-to-medium privilege requirements can exploit this remotely to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS 7.5 score and requirement for authenticated access (PR:L) suggest moderate real-world risk; active exploitation status and POC availability are not confirmed from available data, but the vulnerability class (CWE-98 RFI/LFI) is historically high-value for attackers.

Technical ContextAI

This vulnerability exists in the RealMag777 HUSKY application (CPE: cpe:2:3:realmaag777:husky) and exploits CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The root cause is insufficient sanitization or validation of user-supplied input before passing it to PHP include(), require(), include_once(), or require_once() functions. When an attacker controls the filename parameter, they can traverse the filesystem (e.g., using '../' sequences or absolute paths) or, in some configurations, include remote files via stream wrappers (php://, data://, file://, or phar://). The vulnerability affects HUSKY from an unspecified baseline through version 1.3.7, indicating a long-standing exposure window. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible attack with high complexity and low privilege requirement, suggesting the vulnerable code path is reachable only through authenticated sessions or specific application states.

RemediationAI

Upgrade RealMag777 HUSKY to a version >1.3.7 immediately upon availability (check vendor release notes at RealMag777 official channels). 2) Until patching is possible, implement strict input validation and sanitization on all user-supplied filename parameters before passing to include/require functions; use allowlists of permitted filenames. 3) Disable PHP stream wrappers (allow_url_include=Off, allow_url_fopen=Off) in php.ini to prevent remote file inclusion. 4) Restrict filesystem access permissions on the web server to minimize exposure if LFI is exploited. 5) Implement Web Application Firewall (WAF) rules to detect and block directory traversal patterns (../, %2e%2e%2f) and suspicious include/require payloads. 6) Monitor application logs for unusual include/require activity or filesystem access patterns. 7) Review vendor advisory at RealMag777 for patch details and additional mitigation guidance.