CVE-2026-94062: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Fuelthemes Werkstatt

The vulnerability CVE-2026-94062 affects Fuelthemes Werkstatt through version 4.8.3. It is caused by improper control of the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The attacker can potentially execute arbitrary code or include malicious files via crafted requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Fuelthemes advisories for updates. Until a fix is available, avoid exposing vulnerable endpoints and restrict access to the affected application to trusted users only.