CVE-2026-62065: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in CocoBasic Cardea

CVE-2026-62065 is a Local File Inclusion vulnerability in CocoBasic Cardea versions up to 2.3. The vulnerability arises from improper control of filenames used in PHP include or require statements, classified under CWE-98. This allows unauthenticated attackers to include arbitrary local files, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in disclosure of sensitive files, remote code execution, and full system compromise due to the ability to include arbitrary local files without authentication. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts.