What is the CVSS score of EUVD-2025-28288?

EUVD-2025-28288 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-28288?

A critical file inclusion vulnerability in thembay Sapa (versions up to 1.1.14) allows attackers to access sensitive files on affected servers, potentially exposing confidential data and enabling…

How to fix or mitigate EUVD-2025-28288?

Within 24 hours: Identify all instances of thembay Sapa in your environment and assess exposure (internet-facing vs. internal use). Within 7 days: Implement WAF rules to block malicious file inclusion patterns and isolate affected systems if business-critical. Within 30 days: Upgrade to a patched version when available, or replace thembay Sapa with an alternative solution if the vendor does not release timely fixes.

PHP EUVD-2025-28288

| CVE-2025-49256 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28288

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa allows PHP Local File Inclusion. This issue affects Sapa: from n/a through 1.1.14.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in thembay Sapa that allows unauthenticated remote attackers to include and execute arbitrary PHP files through improper input validation on filename parameters in include/require statements. Affected versions range from an unspecified baseline through version 1.1.14. With a CVSS score of 8.1 and network-accessible attack vector, this vulnerability enables confidentiality, integrity, and availability compromise, though exploitation requires high attack complexity (AC:H) suggesting non-trivial preconditions.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of defects where PHP applications fail to properly sanitize or validate user-supplied input before passing it to include(), require(), include_once(), or require_once() functions. The thembay Sapa product (a PHP-based application, likely a WordPress theme or plugin given the vendor naming convention) does not adequately filter or whitelist filenames, allowing attackers to traverse directory structures or reference remote URLs (if allow_url_include is enabled) to load malicious PHP code. The LFI designation indicates local file inclusion rather than remote file inclusion, meaning the attack leverages files already present on the target server or accessible through directory traversal sequences (../ payloads) rather than remote URLs, though RFI is also possible depending on PHP configuration.

RemediationAI

Immediate Actions:

Upgrade thembay Sapa to a patched version beyond 1.1.14 as soon as available from the vendor.
If patched version is unavailable, disable the Sapa plugin/theme or restrict access to affected pages via .htaccess or WAF rules.
Apply input validation: ensure all user-supplied parameters passed to include/require are validated against a whitelist of allowed filenames; reject any input containing directory traversal sequences (../, .., %, null bytes) or remote URLs.
Disable PHP's allow_url_include directive (set to Off in php.ini) to mitigate remote file inclusion variants.
Monitor web server logs for suspicious include/require patterns (e.g., LFI payloads like /etc/passwd, /var/www/html/wp-config.php, or repeated ../ sequences).
Apply principle of least privilege: run PHP-FPM/Apache under a dedicated unprivileged user account to limit file access.

Vendor Patch: Check thembay's official website, GitHub repository, or WordPress plugin repository for version 1.1.15 or later.