{"id":55903,"date":"2025-06-29T09:29:38","date_gmt":"2025-06-29T09:29:38","guid":{"rendered":""},"modified":"2025-09-12T00:48:14","modified_gmt":"2025-09-12T06:48:14","slug":"cve-2025-49259-critical-php-remote-file-inclusion-vulnerability-in-thembay-hara","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-49259-critical-php-remote-file-inclusion-vulnerability-in-thembay-hara\/","title":{"rendered":"CVE-2025-49259: Critical PHP Remote File Inclusion Vulnerability in Thembay Hara<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The cybersecurity landscape is riddled with potential threats and vulnerabilities. One such vulnerability is the Improper Control of Filename for Include\/Require Statement in PHP Program, commonly known as the PHP Remote File Inclusion vulnerability. This specific vulnerability, labelled as CVE-2025-49259, affects the Thembay Hara system from its earliest version<\/a> through 1.2.10. It poses a significant risk to system integrity and data privacy as it potentially<\/a> allows unauthorized access and data leakage.
\nThis vulnerability is of particular concern due to the rising prevalence of PHP<\/a> in web development, coupled with the widespread use of Thembay Hara. Its exploitation could lead to widespread system<\/a> compromise and significant data breaches if not promptly addressed.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-49259
\nSeverity: Critical (CVSS: 8.1)
\nAttack Vector: Remote
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n