What is the CVSS score of CVE-2026-51925?

CVE-2026-51925 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of docuForm Client are affected by CVE-2026-51925?

docuForm GmbH Client v11.11c contains an arbitrary file disclosure vulnerability (CVE-2026-51925, CVSS 8.1) with publicly available exploit code that allows low-privileged, authenticated attackers to…

How to fix or mitigate CVE-2026-51925?

Within 24 hours: Identify all systems running docuForm Client v11.11c; restrict network access to the dfm-menu_report.php component via firewall rules; review recent access logs for exploitation attempts. Within 7 days: Deploy Web Application Firewall rules blocking path traversal patterns; enable comprehensive logging on affected systems; establish patch monitoring workflow for docuForm GmbH advisories. Within 30 days: Apply vendor patch upon release or upgrade to patched version; validate remediation through vulnerability scanning.

docuForm Client CVE-2026-51925

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 cve@mitre.org

PHP Authentication Bypass RCE

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable authenticated file-read (PR:L, AV:N/AC:L); confidentiality high from arbitrary file disclosure, but I:N/A:N since code execution is unsubstantiated and no availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:28 vuln.today

CVSS changed

Jul 10, 2026 - 16:22 NVD

8.1 (HIGH)

CVE Published

Jul 09, 2026 - 21:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.

AnalysisAI

Arbitrary file disclosure in docuForm GmbH Client v11.11c allows a remote, low-privileged attacker to read sensitive server files through the dfm-menu_report.php component by supplying attacker-controlled path input. The NVD description asserts arbitrary code execution and the vendor gist tags it 'RCE'/'Authentication Bypass', but the concrete described capability is reading configuration files, source code, and system files, with code execution unsubstantiated in the available data. No public exploit is confirmed via a flag, though a third-party gist reference (ZeroBreach-GmbH) is published and likely carries proof-of-concept detail; EPSS is low at 0.35% (27th percentile) and the CVE is not on CISA KEV.

Technical ContextAI

The affected component is a PHP script (dfm-menu_report.php) within docuForm's Client, a document/output-management application from German vendor docuForm GmbH. The assigned weakness is CWE-639 (Authorization Bypass Through User-Controlled Key, i.e., IDOR-style flaws), which points to the application trusting a user-supplied identifier or path parameter to select a report/file resource without proper authorization or path validation. Combined with the 'Local File Inclusion' label, the root cause is an unsanitized file/path parameter passed to a PHP include/read routine, permitting directory traversal and disclosure of files outside the intended report scope. LFI in PHP can, under specific conditions (log poisoning, PHP wrappers, or inclusion of writable/executable content), escalate to code execution, which is the likely basis for the RCE tag though the description only demonstrates file reads.

Affected ProductsAI

docuForm GmbH Client version 11.11c is affected, with the vulnerability located in the dfm-menu_report.php component. No CPE string was provided in the input, and the affected-version range beyond 11.11c is not enumerated in the available data. The only vendor-related reference is the docuForm homepage (https://docuform.de); a third-party proof-of-concept-style writeup is hosted at https://gist.github.com/ZeroBreach-GmbH. No dedicated vendor security advisory URL was supplied.

RemediationAI

No vendor-released patch version was identified at time of analysis; the only vendor reference is the homepage (https://docuform.de), so contact docuForm GmbH directly to confirm a fixed build beyond 11.11c. As compensating controls: restrict network access to the docuForm Client web interface so it is not internet-exposed (place it behind VPN or IP allow-listing), since the vector is AV:N. Add a WAF or reverse-proxy rule to block path-traversal sequences (../, encoded variants, and PHP wrapper prefixes like php://, file://, expect://) and to constrain the file/report parameter accepted by dfm-menu_report.php to an expected allow-list - this may break legitimate report selection if the parameter is dynamically generated, so test first. Enforce least privilege on the web server's OS account and remove read access to sensitive configuration and credential files where feasible to limit disclosure impact. Because the 'Authentication Bypass' tag conflicts with the PR:L vector, also review and harden authentication/authorization on the reporting endpoints. Consult the ZeroBreach-GmbH gist (https://gist.github.com/ZeroBreach-GmbH) only to understand exploit prerequisites for detection tuning.