What is the CVSS score of EUVD-2025-17513?

EUVD-2025-17513 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-17513?

A critical file inclusion vulnerability in Magento Revo (versions through 4.0.26) allows attackers to access sensitive files on affected systems, potentially leading to data exposure, credential…

How to fix or mitigate EUVD-2025-17513?

Within 24 hours: Identify all systems running Magento Revo 4.0.26 or earlier and isolate them from internet-facing access if possible; enable enhanced logging on affected systems. Within 7 days: Implement Web Application Firewall (WAF) rules to block file inclusion attack patterns and restrict access to administrative interfaces; conduct security assessment of potentially affected systems. Within 30 days: Upgrade to Revo 4.0.27 or later when patch becomes available; perform forensic review for signs of exploitation; reset all administrative credentials.

PHP EUVD-2025-17513

| CVE-2025-39476 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17513

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo allows PHP Local File Inclusion. This issue affects Revo: from n/a through 4.0.26.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in magentech Revo versions up to 4.0.26 that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. An attacker can exploit this to read sensitive files, execute code, or compromise the affected system; the vulnerability requires user interaction (UI:R) but carries high impact across confidentiality, integrity, and availability. While no public exploit code or KEV status is currently confirmed in available intelligence, the combination of network accessibility, high CVSS score (7.5), and file inclusion primitives makes this a notable risk for unpatched Revo installations.

Technical ContextAI

This vulnerability exploits a classic PHP file inclusion flaw rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The affected magentech Revo application (an OpenCart-based e-commerce platform) fails to properly sanitize user-supplied input before passing it to PHP's include(), require(), include_once(), or require_once() functions. The underlying mechanism allows attackers to manipulate file path parameters—typically in GET or POST parameters—to reference files outside the intended directory structure. In LFI contexts, this enables reading of /etc/passwd, configuration files containing credentials, application source code, or log files. If combined with file upload functions or log poisoning, LFI can escalate to Remote Code Execution (RCE). The CWE-98 classification indicates the root cause is insufficient input validation and allowlist/blocklist failures on file references.

RemediationAI

Immediate patching: Update magentech Revo to version 4.0.27 or later (assuming the next release after 4.0.26 contains the fix; verify with magentech's official advisory). 2. Workarounds pending patch: Implement strict input validation on all file path parameters—maintain an allowlist of permissible file paths and reject any input deviating from expected patterns. Use PHP's basename() function to strip directory traversal sequences, and employ realpath() to validate that resolved paths remain within safe directories. 3. Web Application Firewall (WAF) rules: Deploy WAF signatures to block common LFI payloads (e.g., patterns containing ../, %2e%2e%2f, or null bytes). 4. Least privilege: Run the PHP application (Apache/Nginx) under a low-privilege user account to limit the scope of file access. 5. Disable dangerous PHP functions: Disable allow_url_include and allow_url_fopen in php.ini to prevent remote file inclusion vectors. 6. Monitor logs: Audit access logs for suspicious file path parameters and evidence of exploitation attempts. 7. Vendor advisory: Check magentech's official support site or security advisories for patched version details and deployment instructions.