CVE-2022-25486

Deeper analysis

CuppaCMS version 1.0 contains a local file inclusion vulnerability in the alerts/alertConfigField.php component, where the url parameter can be abused to include arbitrary local files. The flaw is tracked as CVE-2022-25486 and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low complexity, no required privileges, and the need for user interaction, with high impact on confidentiality, integrity, and availability. It is also associated with CWE-829, indicating inclusion of functionality from an untrusted control sphere.

An attacker who can supply a crafted URL to the affected endpoint is able to read or execute files on the server filesystem. Because the vector requires no authentication and only limited user interaction, a malicious file path supplied through the parameter can disclose sensitive configuration data or, depending on the included file, lead to arbitrary code execution within the web application context.

Public references consist of multiple GitHub issues filed against the CuppaCMS repository together with a repository containing proof-of-concept exploits for several similar local file inclusion flaws in the same alerts module. The associated EPSS score has reached a peak of 0.6883 and currently stands at 0.6591, indicating sustained exploitation interest after disclosure. No official patch or mitigation guidance is referenced in the available sources.