SimplePie EUVD-2026-102346

Requires the victim application to use SimplePie (through 1.9.0) to fetch a feed whose server responses or URL the attacker can influence, and relies on local-file fetching being effective - the pre-patch default, since set_allow_local_files() and the http(s) redirect/autodiscovery restrictions did not yet exist. The attacker then returns an HTTP Location redirect header or an autodiscovery <link> pointing to a file:// path, causing file_get_contents() to read a local file. Limiting factors: the attacker must control the feed server's responses or inject a malicious feed URL into the target application (not a default endpoint), which is reflected in the CVSS AC:H and AT:P metrics; disclosure is bounded to files readable by the web-server process; and patched versions refuse non-http(s) redirects and disable local-file fetching by default.

The supplied CVSS 4.0 vector rates this 8.2 (High), driven by network reachability (AV:N), no required privileges (PR:N), no user interaction (UI:N) and high confidentiality impact (VC:H), with integrity and availability unaffected (VI:N/VA:N). Crucially the same vector carries AC:H and AT:P, signalling that reliable exploitation depends on specific preconditions rather than trivial drive-by access. Publicly available exploit code exists (the abraxas/pfsense-rss-file-redirect PoC referenced in the data), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread active exploitation - this should be treated as a credible, proof-backed vulnerability rather than a mass-exploited emergency. My own CVSS 3.1 assessment lands lower (~5.9) than the headline 8.2 because the attacker must control or inject a feed source and rely on redirect/autodiscovery abuse, consistent with the high-complexity rating. No SSVC decision data was supplied. Overall this is a genuine priority specifically for PHP applications that fetch attacker-influenced feeds, but the AC:H/AT:P conditions temper the raw score.

A malicious or attacker-influenced feed server responds to a SimplePie fetch with a Location redirect header or an autodiscovery link pointing to a file:// path (e.g. file:///etc/passwd or an application config file). SimplePie follows it and file_get_contents() reads the local file, surfacing its contents through the parsed feed where the attacker can harvest them. A public proof-of-concept (abraxas/pfsense-rss-file-redirect) demonstrates the redirect-based variant, and the CVSS AC:H complexity means the attacker must set up the malicious feed response rather than exploit a default endpoint.