Authenticated Local File Inclusion in PHPIPAM by PHPIPAM
CVE-2026-12194

2.3LOW

Key Information:

Vendor

PHPipam

Status
PHPipam
Vendor
CVE Published:
4 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12194?

PHPIPAM is subjected to an authenticated local file inclusion vulnerability that enables users with API access to execute or include arbitrary PHP files from the web server's file system. Although the API feature is not enabled by default, if activated, the flaw could potentially allow attackers to manipulate server files, leading to significant security risks. It is crucial for users to review their configurations and implement recommended mitigations to protect their installations.

Affected Version(s)

phpipam 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12194 - Proof of Concept

References

https://github.com/phpipam/phpipam/pull/4625
mitigation
https://projectblack.io/blog/local-ai-for-cyber-security/...
exploit

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.