{"id":"CVE-2026-113402","kind":"vulnerability","aliases":["CVE-2026-113402"],"related":[],"title":"ArmorX Spam: local file inclusion lets authenticated users include outside files","description":"ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.","summary":"ArmorX Spam has a path traversal flaw that lets a logged-in remote user make the application include PHP files from outside its intended directory. An attacker can use this to run PHP code that is already present on the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ArmorX Spam","fixed":["8.15.2-3.282.133-1.90.061"],"affected":"< 8.15.2-3.282.133-1.90.061","ecosystem":"vendor"}],"ecosystems":[],"tags":["armorx-spam","lfi","other","path-traversal","php","self-hosted"],"not_affected_if":["auth-required","not-installed","patched-8.15.2-3.282.133-1.90.061"],"how_to_check":"Check the installed ArmorX Spam version (appliance/admin UI version info); any version before 8.15.2-3.282.133-1.90.061 is affected. Exposure needs a valid login, so also review who has accounts and whether the admin interface is reachable from the network.","fix":"Update ArmorX Spam to 8.15.2-3.282.133-1.90.061 or later (per TWCERT/CC TVN-202610004).","status":"open","published_at":"2026-10-20T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:46+00:00","updated_at":"2026-10-25T03:39:06+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ArmorX Spam: local file inclusion lets authenticated users include outside files","impact":"high","summary":"ArmorX Spam has a path traversal flaw that lets a logged-in remote user make the application include PHP files from outside its intended directory. An attacker can use this to run PHP code that is already present on the server.","category":"other","nicknames":[],"who_cares":["armorx-spam","php","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"PHP files on the server run for an attacker, possibly leaking secrets","analyst_note":"Find affected and fixed versions and the vendor advisory; the NVD entry alone gives no version range or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-installed","auth-required"],"who_is_affected":"Sites and servers running ArmorX Spam, the spam-filtering product from ArmorX Global Technology. Sources do not name affected versions or say which configurations expose the flaw. Teams not running ArmorX Spam can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000537,"input_tokens":3289,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed versions and the vendor advisory; the NVD entry alone gives no version range or fix.","search":"'-113402':14A,17A '-2026':13A,16A 'alreadi':69B 'applic':49B,97C 'armorx':1A,18A,21B,32B,74C,78C 'armorx-spam':20B 'attack':59B,89C 'authent':7A,87C 'caus':95C 'code':66B 'cve':12A,15A 'develop':76C 'directori':57B,105C 'exploit':91C 'file':4A,11A,52B,84C,101C 'flaw':38B 'global':79C 'host':31B 'includ':9A,50B,99C 'inclus':5A,85C 'intend':56B,104C 'let':6A,40B 'lfi':23B 'local':3A,83C 'log':43B 'logged-in':42B 'make':47B 'outsid':10A,54B,102C 'path':26B,36B,92C 'path-travers':25B 'php':28B,51B,65B,100C 'present':70B 'remot':45B,88C 'run':64B 'self':30B 'self-host':29B 'server':73B 'spam':2A,19A,22B,33B,75C 'technolog':80C 'travers':27B,37B,93C 'use':61B 'user':8A,46B 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted ArmorX Spam (ArmorX Global Technology) at any version before 8.15.2-3.282.133-1.90.061. An attacker needs a valid login, then can use path traversal to make the PHP app include files outside its intended directory, risking disclosure of data and running PHP already on the server. Teams not running ArmorX Spam, or already on the fixed version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113402","severity":null,"published_at":"2026-10-20T07:17:09+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113402:763","url":null,"severity":null,"published_at":"2026-10-25T03:39:06+00:00","modified_at":"2026-10-25T03:39:06+00:00","first_seen_at":"2026-10-25T03:39:06+00:00","fetched_at":"2026-10-25T03:39:06+00:00","note":"TWCERT/CC TVN-202610004 (CNA, not vendor's own page; no vendor advisory found) gives affected < 8.15.2-3.282.133-1.90.061, fix = update to that or later; credit Alston Chen (DEVCORE). No exploitation or PoC found; sibling CVE-2026-113403 in same advisory. Nothing marked verified."}],"documents":[{"id":3256,"url":"https://www.twcert.org.tw/en/cp-139-11295-f2efd-2.html","title":"TWCERT/CC TVN-202610004: ArmorX Spam - 2 Vulnerabilities","kind":"advisory","source":"analyst","text":"TVN-202610004. CVE-2026-113402, CVE-2026-113403. Affected: ArmorX Spam versions prior to 8.15.2-3.282.133-1.90.061. Solution: update to 8.15.2-3.282.133-1.90.061 or later. CVE-2026-113403 command injection, authenticated remote attackers inject crafted commands into a specific parameter, uploading malicious code. Credit: Cyku Hong (DEVCORE). Public date 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3264,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113402","title":"CVE Record CVE-2026-113402","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}