CVE-2025-26757

Summary

CVE-2025-26757 is a critical vulnerability affecting FULL Customer's PHP application version 3.1.26 and below. The issue stems from improper filename control in include/require statements, leading to a PHP Remote File Inclusion (RFI) vulnerability. An attacker can exploit this weakness to execute arbitrary code on the affected system by injecting malicious files. This vulnerability poses a significant risk to FULL Customer's user base, making it essential to apply the necessary patches or upgrades as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.