Description

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T12:16:50.083Z",
  "pubdate": "2026-08-24T12:16:50.083Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in Tonda versions prior to 2.6. This security flaw allows remote, unauthenticated attackers to traverse the file system and include arbitrary local files residing on the host running the vulnerable application.\nThe primary impact of this vulnerability includes potential exposure of sensitive system files, configuration data, and application source code, which can severely compromise the confidentiality and integrity of the underlying host. Depending on the server configuration and the specific files accessible to the application process, successful exploitation may lead to further compromise.\nThe affected product is Tonda, specifically all software versions strictly below 2.6. The risk implications are critical due to the lack of authentication requirements, meaning that any network-adjacent or remote actor capable of reaching the application endpoint can initiate exploitation attempts without prior credentials or interaction.\nExploitation requirements are minimal, relying entirely on the availability of the vulnerable HTTP request handling logic and inadequate input sanitization or validation mechanisms within the affected Tonda components. Attacker capabilities include reading arbitrary files that the application process has permissions to access.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and sanitization of user-supplied parameters utilized within file-handling or inclusion functions in Tonda versions prior to 2.6. When an unauthenticated HTTP request is processed, the application dynamically constructs file paths using parameters derived from user input without adequately restricting directory traversal sequences, such as dot-dot-slash (../) patterns.\nThe vulnerable component involves the internal routing, template rendering, or file retrieval mechanisms responsible for processing input parameters and fetching local resources. Because authentication is not enforced prior to evaluating the inclusion parameter, any remote user can interact directly with the vulnerable endpoint over the network.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request directed at the vulnerable Tonda endpoint, appending directory traversal sequences and target file paths (such as /etc/passwd or application configuration files) to the vulnerable parameter. Second, the server receives the request and passes the unsanitized input directly into the file inclusion or reading function. Third, the application evaluates the path and attempts to read the requested local file from the file system. Finally, the contents of the target file are included in the HTTP response returned to the attacker.\nPayload behavior involves manipulating path parameters to traverse outside the intended web root directory. Post-exploitation impact includes the unauthorized disclosure of sensitive system configuration files, database credentials, environment variables, and source code. If combined with other weaknesses or specific server configurations, such as log poisoning or access to writable directories, LFI vulnerabilities can sometimes be leveraged to achieve remote code execution."
}