The vulnerability CVE-2026-25326 affects CMSMasters Content Composer through improper control of filenames used in PHP include or require statements. This improper control can lead to PHP Local File Inclusion, which may allow an attacker to include unintended files on the server, potentially leading to code execution or information disclosure. The affected versions are up to and including 1.4.5. The CVSS v3.1 score is 7.5, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or disruption of service. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires low privileges but high attack complexity and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions of CMSMasters Content Composer and monitor for updates from the vendor. No specific mitigation steps are provided in the available data.