CVE-2026-62092: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in kutethemes Armania

This vulnerability, identified as CWE-98, involves improper control of filenames used in PHP include or require statements within the Armania product by kutethemes. Versions up to and including 1.4.8 are affected. The flaw allows an unauthenticated attacker to perform local file inclusion, potentially enabling execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution, full system compromise, and unauthorized disclosure or modification of data. The vulnerability affects confidentiality, integrity, and availability of the affected system.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to vulnerable endpoints and monitor for suspicious activity related to file inclusion attempts.