CVE-2026-62074

Summary

The Ozeum application suffers from an unauthenticated Local File Inclusion (LFI) vulnerability that allows attackers to read arbitrary files from the server's filesystem without requiring authentication. This flaw is particularly dangerous because it can lead to sensitive data exposure, including configuration files, database credentials, and potentially remote code execution through PHP includes.

Exploitability

Exploitation is moderately difficult due to the high attack complexity requirement (AC:H) and requires a specific parameter manipulation to trigger the LFI, but no authentication is needed to initiate the attack.

Blast radius

The impact could be significant in environments where Ozeum is deployed with sensitive configuration files or database credentials accessible on the server filesystem, potentially exposing critical infrastructure secrets.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.3.1 or later to address this LFI vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.