EUVD-2025-17510
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd allows PHP Local File Inclusion. This issue affects Krowd: from n/a through 1.4.1.
Analysis
PHP Local File Inclusion (LFI) vulnerability in Gavias Krowd versions up to 1.4.1 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), enabling attackers to read sensitive files or execute malicious code with high complexity but high impact including confidentiality, integrity, and availability compromise. No public exploit code or active exploitation reports are currently available in standard vulnerability databases, but the high CVSS score (8.1) and network-accessible attack vector indicate significant risk for unpatched installations.
Technical Context
The vulnerability exists in the Gavias Krowd theme/plugin framework for PHP-based content management systems. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes the root cause: dynamic file inclusion where user-supplied input is passed directly to PHP include(), require(), include_once(), or require_once() functions without proper validation or sanitization. An attacker can manipulate filename parameters to include local files (LFI) by using path traversal sequences (e.g., '../../../etc/passwd') or PHP wrappers (php://filter/, php://input) to read sensitive configuration files, access source code, or achieve remote code execution if combined with file upload functionality or log injection techniques. The attack surface is the web-facing parameters of Krowd components that handle file inclusion logic.
Affected Products
Krowd (1.4.1 and earlier)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today