CVE-2025-49416

Executive Summary

CVE-2025-49416 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the FW Gallery WordPress plugin (vendor: Fastw3b LLC), affecting all versions up to and including 8.0.0. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities.

The vulnerability is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), though the actual impact is Local File Inclusion (LFI) due to the plugin's context. The CVSS v3.1 base score is 8.1 (High), with the vector emphasizing network-based, low-complexity attacks requiring no privileges or user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes this a significant risk for all sites using the plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The FW Gallery plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, site administrators must consider removing or disabling the plugin immediately. The supply chain risk is elevated because the plugin is widely used for media galleries, and the vulnerability can be exploited without authentication.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access to the server.
• Integrity (I): None (N) – No file modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Threat Level: High. The vulnerability allows unauthenticated attackers to read arbitrary files, including sensitive configuration files. While no public exploit code is available, the attack vector is trivial to implement once the vulnerable parameter is identified.

Deep Dive & Mechanics

The FW Gallery plugin likely uses a PHP include or require statement to load template files or other resources based on user-supplied input. The vulnerability occurs when the plugin fails to sanitize or validate the filename parameter, allowing directory traversal sequences (e.g., ../../) to escape the intended directory.

Root Cause: The plugin uses a parameter like file or template in a URL to dynamically include a PHP file. Without proper filtering, an attacker can supply a path like ../../../../etc/passwd to read system files, or ../../../../wp-config.php to retrieve WordPress database credentials.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., wp-content/plugins/fw-gallery/some-page.php?file=...).
2. Attacker sends a crafted HTTP request with a path traversal payload.
3. The PHP include() function processes the malicious path, reading the target file.
4. The file content is displayed in the HTTP response (if the file is plaintext) or executed (if PHP code).

Impact: Full disclosure of server files, including:

• wp-config.php (database credentials, salts, keys)
• /etc/passwd (user enumeration)
• Application source code (further vulnerability discovery)
• Potentially, if combined with file upload, remote code execution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common LFI vulnerabilities in WordPress plugins.

Vulnerable Code (Hypothetical):

<?php
// vulnerable.php
$file = $_GET['file'];
include("templates/" . $file . ".php");
?>

Patched Code (Hypothetical):

<?php
// patched.php
$allowed_files = array('gallery', 'single', 'list');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include("templates/" . $file . ".php");
} else {
    // error handling
}
?>

Key Differences:

• The patched version uses a whitelist of allowed filenames.
• The vulnerable version directly concatenates user input into the include path.
• Proper input validation and path canonicalization are missing in the vulnerable version.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• WordPress 6.x with FW Gallery plugin version 8.0.0 installed.
• Attacker machine with curl or Burp Suite.

Exploitation Steps:

1. Identify the vulnerable parameter. Common parameters include file, template, page, include, or load.
2. Test for LFI using path traversal:

   curl "http://target.com/wp-content/plugins/fw-gallery/some-page.php?file=../../../../etc/passwd"
   

3. If successful, read sensitive files:

   curl "http://target.com/wp-content/plugins/fw-gallery/some-page.php?file=../../../../wp-config.php"
   

4. For PHP file inclusion (if the file is executed), attempt to include a PHP shell:

   curl "http://target.com/wp-content/plugins/fw-gallery/some-page.php?file=../../../../uploads/malicious.txt%00"
   

   (Note: Null byte injection may work on older PHP versions.)

Expected Output: The contents of /etc/passwd or wp-config.php will be displayed in the HTTP response.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for path traversal patterns:
   • ../ sequences in GET/POST parameters.
   • Requests to plugin files with suspicious file parameters.
2. Check for outbound connections from the web server (if RCE is achieved).
3. Review file integrity on the server for unauthorized modifications.

Hunting Queries:

• Search for fw-gallery in access logs with file= parameter containing ../.
• Look for requests to wp-config.php via the plugin.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ in the file parameter of FW Gallery plugin URLs.
  • Requests to wp-content/plugins/fw-gallery/ with unusual path traversal patterns.
• File System IOCs:
  • Unexpected inclusion of files like /etc/passwd or wp-config.php in web responses.
  • Presence of webshells in upload directories (if RCE is achieved).
• Log IOCs:
  • Web server logs showing 404 or 200 responses for path traversal attempts.
  • PHP error logs indicating failed include() calls.

Detection Engineering

YARA Rule

rule CVE_2025_49416_LFI_FW_Gallery {
    meta:
        description = "Detects path traversal attempts targeting FW Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49416"
    strings:
        $path_traversal = /\.\.\/\.\.\/\.\.\/\.\.\//
        $plugin_path = /wp-content\/plugins\/fw-gallery/
        $param_file = /[?&]file=/
    condition:
        $plugin_path and $param_file and $path_traversal
}

Sigma Rule

title: CVE-2025-49416 FW Gallery LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in FW Gallery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - 'fw-gallery'
            - 'file='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49416 FW Gallery LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/fw-gallery/"; http_uri; content:"file="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the FW Gallery plugin until a patch is released.
2. If the plugin is essential, implement a Web Application Firewall (WAF) rule to block path traversal patterns:
   • Block requests containing ../ in the file parameter.
   • Block requests to wp-content/plugins/fw-gallery/ with suspicious parameters.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Long-term Fix:

• The vendor must release a patched version that implements a whitelist of allowed filenames and uses realpath() to canonicalize paths.
• Alternatively, replace the plugin with a secure alternative.

Workaround:

• Add the following to .htaccess (if using Apache):

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (\.\./|file=.*\.\.) [NC]
  RewriteRule ^wp-content/plugins/fw-gallery/ - [F,L]
  

Valters IT – Securing digital frontiers, one CVE at a time.