ArmorX Spam CVE-2026-113402

Exploitation requires a valid authenticated session on the ArmorX Spam web application (PR:L confirmed in the CVSS vector) - it is not usable by fully unauthenticated attackers. Given that prerequisite, the attacker then supplies path-traversal input to a parameter that the application passes to a PHP include/require (CWE-98), causing inclusion of PHP files outside the intended directory. Limiting factors: the low-privilege credential requirement and the need to reach a specific include-handling endpoint; no user interaction is required (UI:N) and no special non-default configuration is named in the advisory, so default deployments with any valid account appear affected. The exact affected versions are not specified in the provided data.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) describes a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L) and yields high confidentiality impact with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so this is 'no public exploit identified at time of analysis' - exploitation is not confirmed active. The authentication requirement (PR:L, confirmed by the vector) is the primary mitigating factor: an attacker must first obtain valid credentials on the ArmorX Spam console, which meaningfully reduces exposure to opportunistic mass exploitation. Note a conflict worth flagging: the vendor-assigned vector scopes impact as confidentiality-only (VC:H/VI:N/VA:N), yet the description and CWE-98 (improper control of filename for PHP include) imply the application includes PHP files, which commonly enables code execution rather than mere file disclosure - this suggests the integrity/availability impact may be understated and should be verified with the vendor. Overall this is a moderate, authenticated-only priority rather than an internet-wide emergency, given the credential prerequisite, absence of exploitation evidence, and a regional/niche product footprint.

An attacker who already holds a low-privilege authenticated session on the ArmorX Spam web interface submits a request containing path-traversal sequences in a parameter that feeds a PHP include/require call, causing the application to load a PHP file from outside the intended directory. No public exploit code is identified, but CWE-98 LFI with PHP inclusion is a well-understood class, and the low attack complexity (AC:L) means exploitation is straightforward once credentials are obtained. Depending on what files are reachable, this can disclose sensitive application/configuration data or, if attacker-controllable PHP can be reached, lead to code execution.