CozyThemes Rootblox Vulnerability CVE-2026-112832 Rated Critical by NVD
The National Vulnerability Database lists a PHP local file inclusion flaw in Rootblox versions up to 1.0.6 as a critical security issue.
Key points
- CVE-2026-112832 affects CozyThemes Rootblox versions through 1.0.6
- The National Vulnerability Database assigns a CVSS score of 9.8
- The flaw involves improper control of filenames in PHP include statements
The National Vulnerability Database has published a record for CVE-2026-112832, a critical vulnerability in the CozyThemes Rootblox plugin. The advisory identifies an improper control of filename for include or require statements within the PHP program. This issue allows for PHP local file inclusion, according to the NVD entry.
At a glance
- CVE
- CVE-2026-112832
- Product
- CozyThemes Rootblox
- CVSS
- 9.8 Critical
- Weakness
- CWE-98
- Exploited
- No known exploitation
The National Vulnerability Database rates the severity of CVE-2026-112832 at 9.8, which is classified as critical. The weakness is categorized under CWE-98, which covers improper control of filenames for include or require statements. The description explicitly notes that the vulnerability in CozyThemes Rootblox allows PHP local file inclusion.
Technical Details and Classification
The NVD record describes the flaw as an improper control of filename for include or require statements in a PHP program. While the description mentions PHP remote file inclusion in the title context, the specific vulnerability detail states it allows PHP local file inclusion. The Common Weakness Enumeration identifier associated with this issue is CWE-98. This classification relates to how the software handles filename inputs for file operations.
The discrepancy between the mention of remote file inclusion and the specific allowance of local file inclusion is noted in the source text. The NVD record states the vulnerability allows PHP local file inclusion. The title of the weakness description references PHP remote file inclusion, but the detailed description specifies local file inclusion. Analysts should refer to the specific description when assessing the threat.
Affected Software and Versions
The vulnerability affects CozyThemes Rootblox from its initial release through version 1.0.6. The NVD record lists the affected version range as "from n/a through 1.0.6." This means any installation of the Rootblox plugin that has not been updated to a version newer than 1.0.6 is potentially vulnerable. No information is provided regarding versions released after 1.0.6.
CozyThemes is identified as the vendor of the affected software. The product name is Rootblox. The NVD record does not specify a release date for the vulnerability disclosure or a timeline for when the flaw was introduced. It only provides the current status of the affected version range. Security professionals should verify the version of Rootblox installed on their systems.
What should you do?
No fix has been confirmed yet in the source material. Users of CozyThemes Rootblox should check their installed version against the affected range. If running version 1.0.6 or earlier, exposure to CVE-2026-112832 is possible. Monitor official channels for patch information.
What to do and how to stay safe: CozyThemes
- Verify the installed version of CozyThemes Rootblox on all web servers
- Check if the version is 1.0.6 or lower, which falls within the affected range
- Monitor the NVD record for updates on patches or mitigation guidance
- Review server logs for unusual file inclusion attempts or anomalies
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112832?
The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-112832.
Which versions of Rootblox are affected by this vulnerability?
CozyThemes Rootblox versions from the initial release through 1.0.6 are affected.
What type of vulnerability is CVE-2026-112832?
It is a PHP local file inclusion vulnerability due to improper filename control.
