CVE-2025-62066

Name of the Vulnerable Software and Affected Versions Revolution versions prior to 2.5.8

Description An improper control of filename for include/require statements in PHP allows authenticated attackers with subscriber-level access and above to include and execute arbitrary files on the server. This can lead to the execution of PHP code, bypassing access controls, and the retrieval of sensitive data, particularly when images or other safe file types are uploaded and subsequently included.

Recommendations Update to version 2.5.8 or later.