CVE-2025-62067

Name of the Vulnerable Software and Affected Versions Savory versions prior to 2.6

Description An improper control of filename for include/require statements allows unauthenticated attackers to perform Local File Inclusion. This issue enables the inclusion and execution of arbitrary files on the server, which can lead to the execution of PHP code, bypassing of access controls, or the retrieval of sensitive data, particularly when images or other safe file types are uploaded and included.

Recommendations Update Savory to a version newer than 2.5.