CVE-2026-62067: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in CocoBasic Kaven

This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based CocoBasic Kaven product. Versions up to and including 1.2 are affected. The flaw allows an unauthenticated attacker to perform local file inclusion, potentially enabling execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary local files on the server running Kaven, leading to full system compromise including confidentiality breach, integrity violation, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.