CVE-2026-42724

Summary

A vulnerability in CleanSkin versions 1.5.0 and earlier allows unauthenticated local file inclusion, enabling attackers to read arbitrary files on the server filesystem. This represents a high-severity risk as it can lead to data exposure, system compromise, and potential lateral movement within the affected environment.

Exploitability

Exploitation requires no authentication and is relatively straightforward, with attackers able to craft malicious requests to include local files through vulnerable parameters, though specific file paths may need to be discovered or guessed.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive configuration files, database credentials, application source code, and potentially enable further compromise of the entire web application stack.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CleanSkin version 1.5.1 or later to address this local file inclusion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.