CVE-2026-62068: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in CocoBasic Teoro

This vulnerability, identified as CWE-98, arises from improper control of filenames used in include or require statements within the PHP-based CocoBasic Teoro product. Versions up to and including 1.1 are affected. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers can include arbitrary local files, potentially leading to remote code execution or sensitive data disclosure. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the application to untrusted networks if possible.