CVE-2026-62075

Summary

The Backhoe application suffers from an unauthenticated Local File Inclusion (LFI) vulnerability that allows attackers to read arbitrary files from the server's filesystem without any authentication. This flaw is particularly dangerous because it can be exploited remotely without needing valid credentials, potentially exposing sensitive configuration files, database credentials, and application source code.

Exploitability

Exploitation requires sending a crafted request to the vulnerable endpoint with a malicious file path parameter, but no authentication or user interaction is needed, making it relatively easy to exploit with minimal preconditions.

Blast radius

If exploited, this vulnerability could lead to exposure of sensitive application files, database credentials, and potentially allow attackers to execute arbitrary code on the server, affecting all users and data within the application's scope.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Backhoe version 2.1 or later to address this LFI vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.