CVE-2026-51925
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c in the dfm-menu_report.php component. A remote attacker can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files, potentially leading to arbitrary code execution.
Risk Assessment
The risk for the organization includes potential leakage of confidential data such as passwords, API keys or application source code, as well as the possibility of escalating the attack to gain full server control.
Recommendation
It is recommended to immediately update docuForm GmbH Client to the latest available version that fixes this vulnerability. Until the update is applied, restrict access to the dfm-menu_report.php component and implement input validation for URL parameters.
Other vulnerabilities in docuForm GmbH Client
See all- CVE-2026-51924High
A vulnerability in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code via the file upload mechanism and the report.php component.
- CVE-2026-51923High
An IDOR vulnerability in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the user settings component and modify or retrieve sensitive data from other users' accounts.
Original NVD description (English source)
A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.