CVE-2022-27256

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter.

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

1.49% chance of exploitation in the next 30 days, 74th percentile

Published

2022-04-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://volse.net/~haraldei/infosec/disclosures/hubzilla-before-7-2-multiple-vulnerabilit…

Security advisories

• https://hubzilla.org/channel/hubzilla
• https://framagit.org/hubzilla/core/-/commit/0784cd593a39a4fc297e8a82f7e79bc8019a0868#1c49…
• https://volse.net/~haraldei/infosec/disclosures/hubzilla-before-7-2-multiple-vulnerabilit…

References

• CVE Record
• NVD entry