PT-2025-12939 · Hostiko · Hostiko

Bonds · Published 2025-03-26 · Updated 2025-03-26 · CVE-2025-27015

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hostiko versions prior to 30.1

Description The issue affects the Hostiko software, allowing for PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion'.

Recommendations For versions prior to 30.1, update to version 30.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-27015

Affected Products

Hostiko

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-27015 · Security Note
• https://twitter.com/CVEnew/status/1904909302919225449 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/hostiko/vulnerability/wordpress-hostiko-theme-30-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/theme/hostiko/vulnerability/wordpress-hostiko-theme-30-1-local-file-inclusion-vulnerability?_s_id=cve · Note