# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [PHP file inclusion in gibbon](https://agentprime.io/advisories/CVE-2026-8208.md)
  `CVE-2026-8208` · CVE record: gibbonedu gibbon · CVSS 8.9 High · Not analysed yet · Published 9 May 2026 · Tags: File inclusion
- [Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter](https://agentprime.io/advisories/CVE-2026-1620.md)
  `CVE-2026-1620` · CVE record: livemesh Livemesh Addons by Elementor · CVSS 8.8 High · Not analysed yet · Published 16 Apr 2026 · Tags: File inclusion
- [Froxlor has Local File Inclusion via path traversal in API \`def_language\` parameter leads to Remote Code Execution](https://agentprime.io/advisories/GHSA-w59f-67xm-rxx7.md)
  `GHSA-w59f-67xm-rxx7`, `CVE-2026-41228`, `PKSA-t427-p3m6-gf3c` · Packagist `froxlor/froxlor`: affected `<2.3.6`, fixed in `2.3.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: File inclusion
- [BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter](https://agentprime.io/advisories/CVE-2026-39387.md)
  `CVE-2026-39387` · CVE record: BoidCMS BoidCMS · CVSS 7.2 High · Not analysed yet · Published 14 Apr 2026 · Tags: File inclusion
- [A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesyst…](https://agentprime.io/advisories/CVE-2026-30480.md)
  `CVE-2026-30480` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: File inclusion
- [WordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58913.md)
  `CVE-2025-58913` · CVE record: CactusThemes VideoPro · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: File inclusion
- [WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-5804.md)
  `CVE-2025-5804` · CVE record: Case Themes Case Theme User · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: File inclusion
- [WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39684.md)
  `CVE-2026-39684` · CVE record: UnTheme OrganicFood · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39681.md)
  `CVE-2026-39681` · CVE record: ApusTheme Homeo · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39679.md)
  `CVE-2026-39679` · CVE record: ApusTheme Freeio · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39677.md)
  `CVE-2026-39677` · CVE record: Creatives_Planet Emphires · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39623.md)
  `CVE-2026-39623` · CVE record: kutethemes Biolife · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39613.md)
  `CVE-2026-39613` · CVE record: kutethemes Boutique · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39611.md)
  `CVE-2026-39611` · CVE record: kutethemes KuteShop · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39544.md)
  `CVE-2026-39544` · CVE record: themeStek LabtechCO · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39538.md)
  `CVE-2026-39538` · CVE record: Mikado-Themes Mikado Core · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: File inclusion
- [Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter](https://agentprime.io/advisories/CVE-2026-34787.md)
  `CVE-2026-34787` · CVE record: emlog emlog · CVSS 6.5 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: File inclusion
- [HeidiSQL 9.5.0.5196 Denial of Service via Preferences](https://agentprime.io/advisories/CVE-2018-25231.md)
  `CVE-2018-25231` · CVE record: Heidisql HeidiSQL · CVSS 6.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: File inclusion
- [Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php](https://agentprime.io/advisories/GHSA-2mfj-r695-5h9r.md)
  `GHSA-2mfj-r695-5h9r`, `CVE-2026-34036`, `PKSA-bc6q-cg7z-6rnf` · Packagist `dolibarr/dolibarr`: affected `<23.0.0`, fixed in `23.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: File inclusion
- [WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32537.md)
  `CVE-2026-32537` · CVE record: nK Visual Portfolio, Photo Gallery & Post Grid · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32531.md)
  `CVE-2026-32531` · CVE record: gavias Kunco · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32505.md)
  `CVE-2026-32505` · CVE record: CreativeWS Kiddy · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32504.md)
  `CVE-2026-32504` · CVE record: CreativeWS VintWood · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32503.md)
  `CVE-2026-32503` · CVE record: CreativeWS Trendustry · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32500.md)
  `CVE-2026-32500` · CVE record: CreativeWS MetaMax · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27081.md)
  `CVE-2026-27081` · CVE record: Mikado-Themes Rosebud · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Deston theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27080.md)
  `CVE-2026-27080` · CVE record: Mikado-Themes Deston · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27079.md)
  `CVE-2026-27079` · CVE record: Mikado-Themes Amfissa · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27078.md)
  `CVE-2026-27078` · CVE record: Mikado-Themes Emaurri · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27077.md)
  `CVE-2026-27077` · CVE record: Mikado-Themes MultiOffice · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27076.md)
  `CVE-2026-27076` · CVE record: Mikado-Themes LuxeDrive · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Belfort theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27075.md)
  `CVE-2026-27075` · CVE record: Mikado-Themes Belfort · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27048.md)
  `CVE-2026-27048` · CVE record: Elated-Themes The Aisle Core · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27047.md)
  `CVE-2026-27047` · CVE record: Mikado-Themes Curly Core · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25464.md)
  `CVE-2026-25464` · CVE record: TieLabs Jannah · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25458.md)
  `CVE-2026-25458` · CVE record: Select-Themes Moments · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25457.md)
  `CVE-2026-25457` · CVE record: Select-Themes Mixtape · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25382.md)
  `CVE-2026-25382` · CVE record: jwsthemes IdealAuto · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25381.md)
  `CVE-2026-25381` · CVE record: jwsthemes LoveDate · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25380.md)
  `CVE-2026-25380` · CVE record: jwsthemes Feedy · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25379.md)
  `CVE-2026-25379` · CVE record: jwsthemes StreamVid · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25017.md)
  `CVE-2026-25017` · CVE record: stmcan NaturaLife Extensions · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22516.md)
  `CVE-2026-22516` · CVE record: AncoraThemes Wizor's · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22515.md)
  `CVE-2026-22515` · CVE record: AncoraThemes VegaDays · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22514.md)
  `CVE-2026-22514` · CVE record: AncoraThemes Unica · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22513.md)
  `CVE-2026-22513` · CVE record: AncoraThemes Triompher · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22512.md)
  `CVE-2026-22512` · CVE record: Elated-Themes Roisin · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22511.md)
  `CVE-2026-22511` · CVE record: Elated-Themes NeoBeat · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22509.md)
  `CVE-2026-22509` · CVE record: Elated-Themes Gioia · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22508.md)
  `CVE-2026-22508` · CVE record: AncoraThemes Dentalux · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22506.md)
  `CVE-2026-22506` · CVE record: Elated-Themes Amoli · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22504.md)
  `CVE-2026-22504` · CVE record: ThemeREX ProLingua · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22503.md)
  `CVE-2026-22503` · CVE record: ThemeREX Nelson · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22502.md)
  `CVE-2026-22502` · CVE record: AncoraThemes Mr. Cobbler · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22499.md)
  `CVE-2026-22499` · CVE record: Elated-Themes Lella · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22498.md)
  `CVE-2026-22498` · CVE record: Elated-Themes Laurent · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22496.md)
  `CVE-2026-22496` · CVE record: AncoraThemes Hypnotherapy · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Greenville theme <= 1.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22495.md)
  `CVE-2026-22495` · CVE record: AncoraThemes Greenville · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22494.md)
  `CVE-2026-22494` · CVE record: ThemeREX Good Homes · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion
- [WordPress Gaspard theme <= 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22493.md)
  `CVE-2026-22493` · CVE record: Elated-Themes Gaspard · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI2LTAzLTI1VDE2OjE0OjIzLjEzNTAwMFoiLCJDVkUtMjAyNi0yMjQ5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI2LTA1LTEwVDEyOjEyOjQ5LjkxMzAwMFoiLCJDVkUtMjAyMi01MDk1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI2LTA1LTEwVDEyOjEyOjQ5LjkxMzAwMFoiLCJDVkUtMjAyMi01MDk1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.