High · published December 18, 2025
⚡ A crafty oversight in axiomthemes Towny lets attackers pass in any filename they want—like slipping in a friend’s name for a VIP reservation at a trendy restaurant! 🍽️ Picture a guest at an exclusive restaurant who can write their own name on the reservation list—now that’s a recipe for chaos. This vulnerability allows attackers to manipulate file paths in PHP scripts, potentially leading to unauthorized access to sensitive files. An attacker could use this flaw to access or execute files on the server, leading to data leaks or even complete server takeover. This could result in the theft of sensitive information or disruption of service. The consequences are serious and could impact the reputation of your website!
Picture a guest at an exclusive restaurant who can write their own name on the reservation list—now that’s a recipe for chaos. This vulnerability allows attackers to manipulate file paths in PHP scripts, potentially leading to unauthorized access to sensitive files. This vulnerability in axiomthemes allows for Local File Inclusion (LFI) due to the improper control of filenames in PHP's include/require statements. Versions from n/a up to and including 1.16 are affected, meaning that an attacker could control which files are included during execution.
An attacker could use this flaw to access or execute files on the server, leading to data leaks or even complete server takeover. This could result in the theft of sensitive information or disruption of service. The consequences are serious and could impact the reputation of your website! To secure your environment, upgrade to the latest version of Towny as soon as possible. Ensure that all include/require statements are validated to prevent arbitrary file access. Implement strict input validation to block any unauthorized file manipulation. You've got this! With these steps, you can ensure your application is secure and your users are safe! 🛡️