Description

Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T14:17:06.147Z",
  "pubdate": "2026-08-13T14:17:06.147Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability affects the Geo Mashup plugin in versions up to 1.13.18. This security flaw allows remote, unauthenticated attackers to traverse the file system and include arbitrary local files residing on the underlying web server. The vulnerability stems from improper input sanitization and validation of parameters passed to file inclusion routines within the plugin codebase. Successful exploitation of this vulnerability can lead to sensitive information disclosure, including system configuration files, application source code, and credentials, depending on the permissions of the web server process. In certain scenarios involving log poisoning or inclusion of files containing executable code, this vulnerability could potentially lead to remote code execution. The risk implications are severe due to the lack of authentication requirements, enabling opportunistic exploitation by external threat actors over the network. Mitigation requires updating the affected product to a patched version where input parameters are strictly validated and sanitized before file system operations are executed.",
  "technicalDetails": "The vulnerability resides in the Geo Mashup plugin, specifically affecting versions 1.13.18 and prior, where input parameters utilized in file loading or rendering operations are processed without adequate sanitization or boundary validation. Local File Inclusion (LFI) vulnerabilities typically occur when user-supplied input is directly passed to file inclusion functions, such as include, require, file_get_contents, or similar filesystem access APIs in PHP-based applications. In this specific scenario, an unauthenticated attacker can interact with the vulnerable endpoint over the network by supplying a crafted HTTP request containing directory traversal sequences, such as dot-dot-slash (../) patterns, or absolute file paths. The attack flow begins when the vulnerable component receives the malicious parameter without enforcing a strict allowlist or normalizing the path to ensure it remains within the intended application directory. As the request is processed, the underlying PHP interpreter or application logic interprets the manipulated input and attempts to load the requested local resource from the file system. Because no authentication or privilege requirements are mandated by the vulnerable endpoint, any remote actor with network access to the web application can initiate the attack payload. Post-exploitation impact heavily relies on the file system permissions assigned to the web server user account, such as www-data. If the web server process possesses read permissions to sensitive system files, such as /etc/passwd, database configuration files, or other application secrets, the attacker can extract these contents directly in the HTTP response. Furthermore, if the application logs accessible data or handles user-controllable inputs that end up in accessible files, the LFI primitive can be chained with log poisoning techniques to achieve arbitrary remote code execution within the context of the web application server."
}