{"id":"CVE-2026-62074","published":"2026-10-10T20:16:41.737","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/ozeum/vulnerability/wordpress-ozeum-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Ozeum application suffers from an unauthenticated Local File Inclusion (LFI) vulnerability that allows attackers to read arbitrary files from the server's filesystem without requiring authentication. This flaw is particularly dangerous because it can lead to sensitive data exposure, including configuration files, database credentials, and potentially remote code execution through PHP includes.","exploitability":"Exploitation is moderately difficult due to the high attack complexity requirement (AC:H) and requires a specific parameter manipulation to trigger the LFI, but no authentication is needed to initiate the attack.","blast_radius":"The impact could be significant in environments where Ozeum is deployed with sensitive configuration files or database credentials accessible on the server filesystem, potentially exposing critical infrastructure secrets.","remediation":"Upgrade to version 1.3.1 or later to address this LFI vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","file-read","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:08:21.804Z"}}