CVE-2026-12194 LOW

CVE-2026-12194: PHPIPAM Authenticated LFI

Vendor Phpipam

Product phpipam

Weakness CWE-98 · PHP file inclusion

Published July 4, 2026

Last update July 4, 2026

View on NVD All CVEs

CVSS base score

2.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.

Key dates

02Disclosure timeline

July 4, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-12194 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/98.html AskarLabs — CWE-98 write-up PHP Remote File Inclusion

Related vulnerabilities

04Related CVE

CVE-2026-57805 WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability CVE-2026-57800 WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability CVE-2026-66657 WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability CVE-2026-57804 WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability CVE-2026-27412 WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability