PT-2025-43274 · Designervily · Karzo

Published 2025-10-22 · Updated 2025-11-18 · CVE-2025-58955

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Karzo versions prior to 2.6

Description The software contains a flaw related to improper control of filenames used in include/require statements, potentially leading to PHP Local File Inclusion. This allows for the inclusion of local files within the application.

Recommendations Update Karzo to version 2.6 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-58955

Affected Products

Karzo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58955 · Security Note
• https://twitter.com/CVEnew/status/1990786267919913160 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Theme/karzo/vulnerability/wordpress-karzo-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Theme/karzo/vulnerability/wordpress-karzo-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/Wordpress/Theme/karzo/vulnerability/wordpress-karzo-theme-2-6-local-file-inclusion-vulnerability · Note