CVE-2026-113402: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program in ArmorX Global Technology ArmorX Spam

CVE-2026-113402 is a Local File Inclusion vulnerability in ArmorX Spam caused by improper control of filenames used in PHP include/require statements (CWE-98). Authenticated remote attackers can leverage path traversal techniques to include arbitrary PHP files outside the intended directory, which may lead to unauthorized code execution or information disclosure. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity) with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows authenticated remote attackers to include arbitrary PHP files outside the intended directory, potentially leading to unauthorized code execution or disclosure of sensitive information. The high CVSS score reflects significant confidentiality impact and ease of exploitation with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to minimize exposure and monitor for suspicious activity related to file inclusion attempts.