CVE-2026-73387: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in SmartDataSoft Resido

This vulnerability, identified as CVE-2026-73387, affects SmartDataSoft Resido versions up to 1.5. It is caused by improper control of filenames used in include or require statements in PHP, enabling unauthenticated attackers to perform Local File Inclusion (LFI). The CVSS 3.1 score is 8.1 (high), with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.

Successful exploitation can lead to disclosure of sensitive files, code execution, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts.