CVE-2025-26964

Summary

CVE-2025-26964 is a filename manipulation vulnerability affecting Themewinter Eventin, a PHP script, from version n/a to 4.0.20. The issue arises due to improper control of include/require statements, enabling an attacker to potentially include and execute arbitrary local PHP files on the affected system, leading to potential code execution and information disclosure. This vulnerability can be exploited remotely, posing a significant risk to the security of affected installations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.