CVE-2025-11023
Published: 23 October 2025
Summary
CVE-2025-11023 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-11023 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, manifesting as Improper Control of Filename for Include/Require Statement in PHP Program, commonly known as PHP Remote File Inclusion, within ArkSigner Software and Hardware Inc.'s AcBakImzala product. This flaw enables PHP Local File Inclusion and affects all versions of AcBakImzala prior to v5.1.4. It is associated with CWE-98 and CWE-829.
The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by an unauthenticated attacker with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or file access on the affected system.
Mitigation requires upgrading to AcBakImzala v5.1.4 or later. Further details are provided in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0356.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35679
Vulnerability details
Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion. This issue affects AcBakImzala: before v5.1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-11023 is a remote file inclusion vulnerability in a public-facing PHP application, directly enabling exploitation of public-facing applications for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the PHP Remote File Inclusion vulnerability by requiring timely remediation through patching to AcBakImzala v5.1.4 or later.
Prevents exploitation by validating user-supplied filenames in PHP include/require statements to block malicious local or remote file paths.
Enforces secure PHP configuration settings such as open_basedir restrictions and disabling remote file functions to limit the impact of improper filename controls.