CVE-2022-4606

Deeper analysis

CVE-2022-4606 is a PHP remote file inclusion vulnerability, assigned CWE-98, that affects the FlatPress blogging platform in the flatpressblog/flatpress GitHub repository for all versions prior to 1.3. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and can result in full confidentiality, integrity, and availability impacts.

An unauthenticated attacker can supply a crafted remote URL that the application includes and executes, allowing arbitrary PHP code execution on the server and complete system compromise. The vulnerability can be reached directly over the network without any prior access or privileges.

Public references point to a specific commit that resolves the issue and to a coordinated disclosure on huntr.dev; administrators are therefore advised to upgrade to FlatPress 1.3 or later, or to apply the referenced patch.

The associated EPSS score rose from a low baseline to a peak of 0.1980 before settling at the current value of 0.1201, indicating that exploitation interest increased after public disclosure.