PHP EUVD-2025-17485

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical PHP-specific weakness where user-supplied input is passed directly to PHP include() or require() functions without proper validation or sanitization. In the snstheme Avaz plugin, the root cause involves insufficient input filtering on filename parameters, allowing attackers to traverse the filesystem or potentially include remote files (RFI-like behavior despite being classified as LFI). The affected product is snstheme's Avaz theme/plugin for PHP-based web applications, likely WordPress-based given the 'snstheme' vendor designation. The improper filename control permits path traversal sequences (e.g., '../../../') or null byte injection (in older PHP versions) to break out of intended directories and access arbitrary files on the server.