Live › vulnerability › CVE-2026-113402
Go to dashboardArmorX Spam has a path traversal flaw that lets a logged-in remote user make the application include PHP files from outside its intended directory. An attacker can use this to run PHP code that is already present on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running self-hosted ArmorX Spam (ArmorX Global Technology) at any version before 8.15.2-3.282.133-1.90.061. An attacker needs a valid login, then can use path traversal to make the PHP app include files outside its intended directory, risking disclosure of data and running PHP already on the server. Teams not running ArmorX Spam, or already on the fixed version, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArmorX Spam | vendor | < 8.15.2-3.282.133-1.90.061 | 8.15.2-3.282.133-1.90.061 |
8.15.2-3.282.133-1.90.061 is affectedUpdate ArmorX Spam to 8.15.2-3.282.133-1.90.061 or later (per TWCERT/CC TVN-202610004).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-113402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.