What is the CVSS score of CVE-2026-25464?

CVE-2026-25464 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25464?

CVE-2026-25464 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-25464?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-25464

EUVD-2026-15748 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15748

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.3.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in TieLabs Jannah WordPress theme through version 7.6.3, stemming from improper control of filename parameters in PHP include/require statements. An attacker can exploit this vulnerability to read arbitrary local files from the affected server, potentially disclosing sensitive configuration files, credentials, or source code. No CVSS score, EPSS data, or active KEV listing is currently available, but the LFI classification and information disclosure impact indicate moderate to high real-world risk depending on server configuration and file permissions.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic web application flaw where user-supplied input is passed unsanitized to PHP's include() or require() functions. The Jannah theme (cpe:2.3:a:tielabs:jannah:*:*:*:*:*:*:*:*) is a WordPress theme that processes filename parameters without proper validation or filtering, allowing path traversal sequences (e.g., ../) or absolute paths to be injected. This enables attackers to load arbitrary local files on the server, transforming a remote file inclusion vulnerability into a local file inclusion attack when remote URL wrappers are disabled or filtered.

RemediationAI

Upgrade TieLabs Jannah theme to a version greater than 7.6.3 immediately, as a patched version should be available from the vendor or WordPress.org. Verify the patch version through the official Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-3-local-file-inclusion-vulnerability) or contact TieLabs support directly. As an interim mitigation, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, ..\, etc.) and restrict PHP's file inclusion functions using php.ini directives (disable_functions, open_basedir). Additionally, enforce strict file permissions to limit exposure of sensitive configuration files, monitor access logs for suspicious inclusion attempts, and consider disabling remote file inclusion (allow_url_include = off) if not required by the application.