CVE-2026-48193: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in kutethemes Uminex

This vulnerability, identified as CWE-98, arises from improper control of filenames in include or require statements within the PHP code of kutethemes Uminex. Versions up to and including 1.0.9 are affected. The flaw allows unauthenticated attackers to perform Local File Inclusion, which can lead to remote code execution or disclosure of sensitive files. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, unauthorized code execution, and disruption of service. Since the vulnerability is unauthenticated, it can be exploited remotely without credentials. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.