CVE-2026-66656

HighCVSS 8.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

The Foton Core plugin version 1.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.

Risk Assessment

The risk includes disclosure of sensitive information such as passwords, API keys, or personal data. This could lead to further attacks on the infrastructure.

Recommendation

It is recommended to update the Foton Core plugin to a version newer than 1.1.1. Also, restrict file access and apply path filtering mechanisms.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.