Description

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T13:18:08.033Z",
  "pubdate": "2026-08-19T13:18:08.033Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the Resido product affecting versions 1.5 and prior. This security flaw introduces significant risk by allowing remote, unauthenticated attackers to traverse the filesystem and access sensitive system files or execute arbitrary file inclusion depending on the underlying application configuration and PHP wrappers. The vulnerability impacts confidentiality and integrity, potentially exposing configuration files, source code, or system credentials to malicious actors without requiring prior system access, valid credentials, or specific user interaction. The root cause stems from improper input validation and sanitization of user-supplied parameters utilized in file inclusion or loading routines within the affected software. Remediation requires strict input filtering, implementing allowlists for file paths, and updating to a patched version once officially released by the vendor.",
  "technicalDetails": "The vulnerability resides in the Resido product across versions 1.5 and lower, specifically within components handling dynamic file loading or path resolution based on unvalidated user input. The root cause is the direct utilization of tainted HTTP request parameters within file system access functions without adequate neutralization of directory traversal sequences such as dot-dot-slash (../) patterns.\nAttack flow begins when an unauthenticated remote attacker crafts an HTTP request targeting the vulnerable endpoint, injecting traversal sequences or absolute file paths into the vulnerable parameter. Because the application lacks proper authentication requirements and privilege checks for this functionality, the request is processed directly by the server.\nNetwork exposure is external, meaning any network-adjacent or remote attacker with HTTP/HTTPS access to the instance can initiate exploitation attempts. Privilege requirements are nonexistent (unauthenticated), lowering the barrier to entry for malicious actors.\nDuring payload behavior, the application resolves the manipulated path relative to the web root or operating system root directory, depending on how the underlying file inclusion mechanism is implemented. If PHP-based functions such as include, require, file_get_contents, or similar primitives are improperly invoked with the attacker-controlled input, the application proceeds to read or execute the targeted local file.\nThe post-exploitation impact includes the unauthorized disclosure of sensitive local files, such as /etc/passwd, application configuration files containing database credentials, API keys, or source code. If combined with techniques like log poisoning or upload vectors, this LFI flaw could potentially escalate to remote code execution (RCE) within the context of the web server user."
}