CVE-2026-65477

The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

The risk is leakage of sensitive data such as configuration files with passwords, potentially leading to further privilege escalation or server compromise.

Update the Tonda Core plugin to version 2.1.3 or later, which fixes this vulnerability.