CVE-2026-62066: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in CocoBasic Volos

This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based CocoBasic Volos product. Versions 1.2 and earlier are affected. An unauthenticated attacker can exploit this flaw to perform local file inclusion, which may allow execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution, full system compromise, and disclosure of sensitive data. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.