Description

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T14:17:02.717Z",
  "pubdate": "2026-08-18T14:17:02.717Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in Vavo Core versions <= 2.3.0. This security flaw arises from improper input validation and handling of file path parameters within the application core. The vulnerability allows remote, unauthenticated attackers to traverse the file system and access arbitrary files residing on the underlying host operating system.\nSuccessful exploitation of this flaw can lead to the unauthorized disclosure of sensitive system files, configuration data, and potentially source code, depending on the privileges of the web server process. The risk implications are severe, as information gathered via local file inclusion can facilitate further attacks, including remote code execution or complete system compromise. Because the vulnerability requires no prior authentication or specialized privileges, the attack surface is broad, exposing any publicly accessible deployment of Vavo Core <= 2.3.0.\nExploitation requirements are minimal, typically needing only network connectivity to the vulnerable web application and the ability to craft HTTP requests containing directory traversal sequences. Organizations utilizing affected versions face significant exposure until remediation actions are applied.",
  "technicalDetails": "The vulnerability exists within the input handling and file retrieval mechanisms of Vavo Core versions <= 2.3.0. The root cause is the direct utilization of user-supplied input within file system operations without adequate sanitization, canonicalization, or validation against a restricted directory whitelist.\nThe affected component is responsible for dynamically loading or reading files based on HTTP request parameters. Because the application fails to properly neutralize directory traversal sequences such as dot-dot-slash (../) patterns, an attacker can manipulate the path parameter to traverse outside the intended web root and access arbitrary files on the system.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies an HTTP endpoint in Vavo Core that accepts a file-related parameter. Second, the attacker crafts a malicious HTTP GET or POST request containing specially encoded traversal sequences (e.g., ../../../../etc/passwd on Linux-based deployments). Third, the vulnerable application processes the parameter and passes the unvalidated path directly to the underlying file system APIs. Finally, the application reads the targeted system file and includes its contents directly in the HTTP response returned to the attacker.\nNetwork exposure is direct, as the vulnerable endpoints are accessible over standard HTTP/HTTPS protocols without authentication requirements. Privilege requirements are nonexistent, allowing any external entity with network access to initiate exploitation. Payload behavior involves reading sensitive system files, configuration files containing database credentials, or application source code. Post-exploitation impact includes information disclosure, credential theft, and the potential escalation of privileges or secondary attacks leveraging leaked system configuration details."
}