EUVD-2025-17549
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Path Traversal vulnerability in Mikado-Themes MediClinic allows PHP Local File Inclusion. This issue affects MediClinic: from n/a through 2.1.
Analysis
A Path Traversal vulnerability in Mikado-Themes MediClinic through version 2.1 enables unauthenticated remote attackers to conduct PHP Local File Inclusion (LFI) attacks, potentially allowing arbitrary file reading and code execution. The CVSS 8.1 score reflects high impact across confidentiality, integrity, and availability, though attack complexity is listed as HIGH. No public confirmation of active KEV exploitation or PoC availability is documented in standard feeds, but the high CVSS and LFI vector suggest this should be treated as a credible priority vulnerability.
Technical Context
The vulnerability stems from improper input validation in MediClinic's PHP file handling, classified under CWE-35 (Path Traversal), which enables attackers to manipulate file paths using directory traversal sequences (e.g., '../') or absolute paths to access files outside intended directories. MediClinic is a WordPress theme distributed by Mikado-Themes. The affected versions range from an unspecified baseline through version 2.1. The LFI vector is particularly dangerous in PHP environments as it can lead to Remote Code Execution (RCE) through log poisoning, session file manipulation, or inclusion of user-controllable data streams. The CPE for this product would be vendor:mikado-themes:mediClinic, with affected versions 2.1 and below.
Affected Products
MediClinic (≤ 2.1)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today