CVE-2026-125795
Deferred Deferred - Pending Action

PHP Local File Inclusion in Estatik Plugin

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-125795
EUVD
EUVD-2026-126084

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
estatik estatik to 4.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Remote File Inclusion vulnerability where improper control of filenames in include/require statements allows attackers to include malicious PHP files from remote or local sources. It affects Estatik versions up to 4.3.6.

Detection Guidance

Check for vulnerable Estatik versions (up to 4.3.6) by inspecting installed plugins or themes. Look for unusual file inclusions in PHP logs or web server access logs. Use commands like grep -r 'include' /var/www/ to search for potential vulnerable code patterns.

Impact Analysis

An attacker could execute arbitrary code on the server, steal sensitive data, or take full control of the affected system. This could lead to data breaches, defacement, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update Estatik to the latest version beyond 4.3.6 immediately. Disable file inclusion functions like allow_url_include in php.ini. Restrict file permissions to prevent unauthorized access. Monitor network traffic for suspicious file requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...