CVE-2025-23938

Summary

CVE-2025-23938 is a filename manipulation vulnerability affecting the NotFound Image Gallery Box by CRUDLab. The PHP Remote File Inclusion (RFI) issue enables an attacker to include local files on the affected system by controlling the filename for include or require statements. This vulnerability can be exploited to gain unauthorized access to sensitive data or execute arbitrary code. The issue affects Image Gallery Box by CRUDLab versions from n/a through 1.0.3. It is crucial for users to update their systems to a patched version to mitigate the risk of exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.