Intel

CVE-2026-94062

Eine unzureichende Kontrolle des Dateinamens für die Include/Require-Anweisung in einem PHP-Programm („PHP Remote File Inclusion“) führt …

high

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

Source: cvelistv5NVD (NIST)

Metrics

XIEM Effective CVSS
8.1
Source: cna-v3
KEV status
—
Show all metrics
Severity
high
Priority score
70.50
Exploit maturity
no public PoC known
CVSS v3
8.1
Published
2026-10-09 13:00 UTC
CWE
CWE-98

Weakness classes (CWE)

  • CWE-98Variant

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

    The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-09 18:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-94062","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-10-09 13:17 UTC· audit@patchstack.com
    • Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-98
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/94xxx/CVE-2026-94062.json">CVE-2026-94062</a>