CVE-2026-28150: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in uxper Golo Framework

CVE-2026-28150 is an unauthenticated Local File Inclusion vulnerability in the uxper Golo Framework before version 1.7.5. The flaw stems from improper control of filenames used in PHP include or require statements (CWE-98). Exploiting this vulnerability could allow an attacker to include arbitrary local files, resulting in high impact on confidentiality, integrity, and availability. The CVSS v3.1 score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on all security properties. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, and potential full system compromise due to arbitrary file inclusion. The impact is rated high with full confidentiality, integrity, and availability loss possible. Since the vulnerability is unauthenticated, any remote attacker can attempt exploitation over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable versions of the Golo Framework and consider applying temporary mitigations such as disabling vulnerable functionality or implementing strict input validation on filenames used in include/require statements.