PT-2026-55685 · Phpipam · Phpipam
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
PHPIPAM (affected versions not specified)
Description
An authenticated local file inclusion issue exists that allows users with API access to execute or include arbitrary PHP files located on the web server's file system. Local File Inclusion (LFI) is a flaw that allows an attacker to read or execute files on the server. The API is not enabled by default in standard installations.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Restrict access to the API to minimize the risk of exploitation.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Phpipam