CVE-2025-11023
Published: 23 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-11023 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, manifesting as Improper Control of Filename for Include/Require Statement in PHP Program, commonly known as PHP Remote File Inclusion, within ArkSigner Software and Hardware Inc.'s AcBakImzala product. This flaw enables PHP Local File Inclusion and affects all versions of AcBakImzala prior to v5.1.4. It is associated with CWE-98 and CWE-829.
The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by an unauthenticated attacker with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or file access on the affected system.
Mitigation requires upgrading to AcBakImzala v5.1.4 or later. Further details are provided in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0356.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2025-11023 is a remote file inclusion vulnerability in a public-facing PHP application, directly enabling exploitation of public-facing applications for arbitrary code execution.