CVE-2026-111234
Received Received - Intake

SimplePie Local File Read Vulnerability via file:// URL Handling

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111234
EUVD
EUVD-2026-102346

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SimplePie simplepie 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SimplePie through version 1.9.0 has a local file read vulnerability. Malicious feed servers can exploit this by providing file:// URLs in redirects or autodiscovery links. When SimplePie processes these URLs, it uses file_get_contents() to read files accessible to the web server process, potentially exposing sensitive server files.

Detection Guidance

Check SimplePie installations for file:// URLs in redirects or autodiscovery links. Inspect web server logs for file:// paths in Location headers or feed links. Use grep to search for file:// patterns in web server access logs or SimplePie configuration files.

Impact Analysis

This vulnerability allows attackers to read files on the server where SimplePie is running. If the web server has access to sensitive files like configuration files, credentials, or other restricted data, those files could be exposed. This could lead to further attacks or data breaches depending on the exposed files.

Mitigation Strategies

Upgrade SimplePie to the latest version beyond 1.9.0. Disable file:// URL handling in SimplePie or web server configurations. Restrict web server process permissions to limit file access. Monitor network traffic for suspicious file:// requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111234. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart