CVE-2026-32364: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in redqteam Turbo Manager
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-32364 affects redqteam's Turbo Manager versions before 4.0.8. It is caused by improper validation or control of filenames used in PHP include or require statements, which enables PHP Local File Inclusion. This can allow an attacker with low privileges to include and execute local files on the server, potentially leading to full compromise of the system. The CVSS score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.
Potential Impact
Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on the affected Turbo Manager installations. The attacker requires only low privileges and no user interaction, but must overcome high attack complexity. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users of Turbo Manager should monitor vendor communications closely and apply updates once available. Until then, restricting access to the application and minimizing privileges may reduce risk.
CVE-2026-32364: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in redqteam Turbo Manager
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-32364 affects redqteam's Turbo Manager versions before 4.0.8. It is caused by improper validation or control of filenames used in PHP include or require statements, which enables PHP Local File Inclusion. This can allow an attacker with low privileges to include and execute local files on the server, potentially leading to full compromise of the system. The CVSS score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.
Potential Impact
Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on the affected Turbo Manager installations. The attacker requires only low privileges and no user interaction, but must overcome high attack complexity. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users of Turbo Manager should monitor vendor communications closely and apply updates once available. Until then, restricting access to the application and minimizing privileges may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Patchstack
- Date Reserved
- 2026-03-12T11:10:53.774Z
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 69b3fc6f2f860ef943d179bd
Added to database: 3/13/2026, 12:00:47 PM
Last enriched: 4/3/2026, 12:25:38 PM
Last updated: 4/29/2026, 12:37:10 AM
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.