PT-2026-21092 · Thembay · Zota Zota
CVE-2025-68536
·
Published
2026-02-20
·
Updated
2026-02-20
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
thembay Zota zota versions through 1.3.14
Description
A flaw exists in the handling of filenames for include/require statements within a PHP program, specifically a PHP Remote File Inclusion issue in thembay Zota zota. This allows for PHP Local File Inclusion. The issue involves improper control of filenames used in include/require operations, potentially allowing an attacker to include arbitrary local files.
Recommendations
Versions prior to 1.3.14 should be updated.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zota Zota