CVE-2026-62068

Deferred Deferred - Pending Action

Unauthenticated Local File Inclusion in Teoro

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62068

EUVD

EUVD-2026-96483

Affected Vendors & Products

Vendor	Product	Version / Range
CocoBasic	Teoro	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

This is an Unauthenticated Local File Inclusion vulnerability in Teoro versions 1.1 and below. It allows an attacker to include local files on the server without authentication, potentially leading to unauthorized data access or code execution.

Detection Guidance

To detect this vulnerability, check if your Teoro theme version is 1.1 or lower. Inspect server logs for unusual file inclusion attempts or unauthorized access patterns. No specific commands are provided in the context, but monitoring for LFI indicators like path traversal sequences (../) in requests may help.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, such as configuration files, passwords, or other confidential data. This may lead to further attacks like remote code execution or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Organizations may face legal penalties, fines, or reputational damage due to data breaches.

Mitigation Strategies

Immediately update Teoro to a version later than 1.1 to patch the Local File Inclusion vulnerability. If an update is not available, consider disabling or removing the software until a fix is released.

Hi! I’m here to help you understand CVE-2026-62068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70