Is there a public PoC exploit available for CVE-2026-12194?

Yes, a public proof-of-concept exploit is available for CVE-2026-12194. Prioritise patching immediately. EPSS: 0.4%.

PHPIPAM CVE-2026-12194

Q: What is the CVSS score of CVE-2026-12194?

CVE-2026-12194 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41659 LOW

PHP Remote File Inclusion (CWE-98)

2026-07-04 PRJBLK

GHSA-cr5v-q482-32fc

LFI Information Disclosure PHP Phpipam

2.3

CVSS 4.0 · Vendor: PRJBLK

Severity by source

Vendor (PRJBLK) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Non-default API prerequisite maps to AC:H; authenticated low-privilege access required (PR:L); limited confidentiality impact from file inclusion (C:L); no integrity or availability impact observed.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (PRJBLK).

CVSS VectorVendor: PRJBLK

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 07:47 vuln.today

DescriptionCVE.org

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.

AnalysisAI

PHP file inclusion in PHPIPAM allows authenticated API users to include and execute arbitrary PHP files from the web server's filesystem, with primary impact on application confidentiality through exposure of sensitive configuration data. Exploitation is gated behind two non-default conditions: the REST API must be deliberately enabled by an administrator, and the attacker must hold valid API credentials - constraining the realistic attack surface substantially. Publicly available exploit code exists per Project Black's research blog, though the vulnerability carries a CVSS 4.0 score of 2.3 and is absent from CISA KEV, reflecting its narrow exploitation prerequisites rather than widespread threat activity.

Technical ContextAI

PHPIPAM is an open-source PHP-based IP address management application (CPE: cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a PHP-specific subclass of path traversal in which user-supplied input reaches a PHP include() or require() call without adequate sanitization. This allows an authenticated API caller to inject an arbitrary filesystem path, causing the PHP interpreter to load and parse the targeted file within the webserver process context. The CVSS 4.0 vector designates AT:P (attack requirements present) specifically because the API component is disabled by default and must be explicitly activated by an administrator before the vulnerable code path is reachable.

RemediationAI

Monitor the PHPIPAM project at https://github.com/phpipam/phpipam/pull/4625 and apply the fix once merged into a tagged release; upgrade to that release as the primary remediation step. Until a formal patched release is available, the most effective compensating control is to disable the PHPIPAM API entirely if it is not operationally required - since the API is off by default, organizations that have not enabled it are fully unaffected and require no additional action. For deployments that require the API, restrict API endpoint access to trusted internal IP ranges at the network perimeter or web server layer (e.g., nginx or Apache allow/deny directives), reducing the pool of callers who can supply crafted file paths; note this introduces operational friction for legitimate remote API consumers. Additionally, audit and minimize the scope of API user permissions, ensuring no account has broader access than the minimum needed. No vendor-issued workaround documentation beyond disabling the API was identified in the referenced materials.