CVE-2025-11023

Critical

Published: 23 October 2025

Published

23 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0015 34.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11023 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the PHP Remote File Inclusion vulnerability by requiring timely remediation through patching to AcBakImzala v5.1.4 or later.

SI-10 Information Input Validation good match

prevent

Prevents exploitation by validating user-supplied filenames in PHP include/require statements to block malicious local or remote file paths.

CM-6 Configuration Settings partial match

prevent

Enforces secure PHP configuration settings such as open_basedir restrictions and disabling remote file functions to limit the impact of improper filename controls.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-11023 is a remote file inclusion vulnerability in a public-facing PHP application, directly enabling exploitation of public-facing applications for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion.This issue affects AcBakImzala: before v5.1.4.

Deeper analysisAI

CVE-2025-11023 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, manifesting as Improper Control of Filename for Include/Require Statement in PHP Program, commonly known as PHP Remote File Inclusion, within ArkSigner Software and Hardware Inc.'s AcBakImzala product. This flaw enables PHP Local File Inclusion and affects all versions of AcBakImzala prior to v5.1.4. It is associated with CWE-98 and CWE-829.

The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by an unauthenticated attacker with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or file access on the affected system.

Mitigation requires upgrading to AcBakImzala v5.1.4 or later. Further details are provided in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0356.