Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox… (CVE-2026-112832)

This vulnerability arises from improper control of the filename used in PHP include or require statements within CozyThemes Rootblox, enabling local file inclusion (LFI). The affected versions include all releases up to and including 1.0.6. The flaw allows an attacker to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full system compromise including disclosure of sensitive data, modification of system files, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, avoid exposing vulnerable versions to untrusted networks or users.