Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Docpro up to 2.0.1 lets attackers include arbitrary files

CVE-2025-28916 · published 1 year ago
Summary

The Docpro document management system (versions up to 2.0.1) can be tricked into loading files it should not access. An attacker could cause the application to run malicious code or reveal sensitive data stored on the server. Upgrade to a fixed version or apply the vendor’s patch to stop this behavior.

Original advisory text
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docp...
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through <= 2.0.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-98Improper Control of Filename for Include
Timeline
Published26 Mar 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-28916 · NVD
Track software like this
Free during beta