CVE-2026-48194

Summary

DukaMarket v1.3.0 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files on the server. This flaw can lead to sensitive data exposure, including configuration files, database credentials, and application source code.

Exploitability

Exploitation requires no authentication and is relatively straightforward with a single HTTP request, though it may require knowledge of file paths or specific file types to maximize impact.

Blast radius

If exploited, this vulnerability could expose sensitive server files including database credentials, configuration settings, and application source code, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to DukaMarket version 1.3.1 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.