Threats tagged 'ghsa-3cfv-f88w-c563'

A critical vulnerability identified as CVE-2026-125795 affects Estatik through version 4.3.6. It involves improper control of filenames used in PHP include or require statements, leading to a PHP Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to include local files on the server, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed.