CVE-2026-48194: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in kutethemes DukaMarket

This vulnerability (CVE-2026-48194) affects DukaMarket versions up to 1.3.0 by allowing unauthenticated attackers to perform Local File Inclusion (LFI) through improper control of filenames used in PHP include or require statements. The issue is categorized under CWE-98, which concerns improper control of filename or path in include/require statements, enabling attackers to include arbitrary local files. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive files, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.