CVE-2026-12194
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.
Risk Assessment
An attacker with API access can take over the web server by executing malicious PHP code, leading to full system and data compromise.
Recommendation
It is recommended to disable the API if not required and immediately update PHPIPAM to the latest patched version.
Original NVD description (English source)
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.