Description

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T12:16:50.220Z",
  "pubdate": "2026-08-24T12:16:50.220Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability exists in Tonda Core versions prior to 2.6.\nThis security flaw enables remote attackers to read arbitrary files from the underlying operating system running the vulnerable software.\nThe vulnerability directly impacts confidentiality, as unauthorized actors can access sensitive configuration files, system credentials, or source code without authentication.\nThe risk implication is severe, potentially leading to total system compromise if sensitive files are leveraged for further attacks.\nAttacker capabilities include issuing crafted HTTP requests to traverse directory structures and retrieve system files.\nExploitation requirements are minimal, as the attack vector is completely unauthenticated and network-accessible, requiring no prior system access or user interaction against Tonda Core < 2.6.",
  "technicalDetails": "The vulnerability resides in the input handling mechanism of Tonda Core versions prior to 2.6, specifically within the component responsible for processing file retrieval or resource loading requests.\nThe root cause is insufficient input sanitization and lack of proper path normalization, allowing user-supplied input to directly influence file system operations.\nAttackers exploit this flaw by submitting specially crafted path traversal sequences (such as dot-dot-slash patterns) via parameters processed by the vulnerable application endpoints.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request containing relative path specifiers aimed at target system files, such as /etc/passwd.\nSecond, the request is transmitted across the network to the exposed Tonda Core instance.\nThird, the vulnerable component fails to validate or restrict the file path boundaries, passing the attacker-controlled string directly to the underlying file system APIs.\nFourth, the application reads the targeted file from disk and includes its contents directly within the HTTP response returned to the client.\nAuthentication and privilege requirements are entirely absent, allowing any external network adversary to trigger the flaw.\nNetwork exposure is direct, as the vulnerable endpoints are accessible over the network interface hosting the Tonda Core service.\nPost-exploitation impact includes the unauthorized disclosure of sensitive data, configuration parameters, and internal application logic, which facilitates subsequent privilege escalation or lateral movement."
}