High severity8.1NVD Advisory· Published Oct 22, 2025· Updated Apr 15, 2026
CVE-2025-58955
CVE-2025-58955
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.
Affected products
2< 2.6+ 1 more
- (no CPE)range: < 2.6
- (no CPE)range: <2.6
Package: https://wordpress.org/themes/karzo
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.