CVE-2025-27272

Summary

CVE-2025-27272 is a filename vulnerability affecting the VG PostCarousel PHP module. The issue resides in the inadequate control of filename for include/require statements, resulting in a Local File Inclusion (LFI) vulnerability. An attacker can exploit this flaw to access and execute arbitrary local files, posing a serious threat to the confidentiality and integrity of affected systems. The vulnerability is present in VG PostCarousel versions from n/a through 1.1. Updating to a secure version or implementing appropriate security measures is highly recommended to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.