CVE-2026-94062

Summary

This PHP application is vulnerable to Local File Inclusion (LFI) due to improper handling of filename parameters in include/require statements, allowing attackers to include arbitrary local files and potentially execute arbitrary code or read sensitive data.

Exploitability

Exploitation requires a remote attacker with no authentication to send a crafted request with a malicious filename parameter, making it moderately difficult to exploit but possible with minimal preconditions.

Blast radius

If exploited, this vulnerability could allow attackers to read arbitrary files from the server filesystem, potentially including configuration files with database credentials, or execute arbitrary PHP code, leading to full server compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Werkstatt version 4.8.4 or later to remediate this LFI vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.