EUVD-2025-18533
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana allows PHP Local File Inclusion. This issue affects Fana: from n/a through 1.1.28.
Analysis
PHP Local File Inclusion (LFI) vulnerability in thembay Fana versions through 1.1.28 that allows unauthenticated remote attackers to include and execute arbitrary files through improper control of filename parameters in PHP include/require statements. The high CVSS score of 8.1 reflects the potential for confidentiality, integrity, and availability impact, though the 'H' attack complexity suggests exploitation requires specific conditions or knowledge of the application architecture. No publicly confirmed KEV or widespread active exploitation is documented, but the 2025 CVE date indicates this is a recently disclosed vulnerability requiring immediate attention from Fana users.
Technical Context
The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of defects where user-controlled input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. In thembay Fana (a PHP-based application/theme/plugin), an attacker can manipulate filename parameters to point to arbitrary local files on the server filesystem. Unlike Remote File Inclusion (RFI), LFI is constrained to files accessible to the web server process, but can still lead to code execution through techniques such as: log file inclusion (if logs contain attacker-controlled content), session file inclusion, or temporary file inclusion. The affected product identifier would be: cpe:2.3:a:thembay:fana:*:*:*:*:*:*:*:* (versions up to 1.1.28). This vulnerability is particularly dangerous in shared hosting environments where attackers can chain LFI with other attack vectors (e.g., mail header injection to write to log files).
Affected Products
Fana (1.1.28 and earlier)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today