CVE-2025-65656

The vulnerability classified as CWE-98 (PHP Remote File Inclusion) consists of improper file name validation used in the include/require instruction in the VersionManager.php file. An attacker can provide a crafted value pointing to an external or local resource, resulting in the inclusion and execution of untrusted PHP code. Due to the network vector (AV:N) and lack of permission requirements (PR:N) and user interaction (UI:N), the attack can be performed remotely by an unauthenticated attacker.

An attacker can achieve complete server compromise through remote code execution (RCE), as well as gain access to sensitive data, modify it, or cause application unavailability.

Patches available from the vendor should be applied in accordance with the references. It is recommended to monitor the project repository (https://github.com/jqhph/dcat-admin) to obtain the updated version and implement the patch immediately. Until the patch is applied, it is recommended to restrict network access to the Dcat Admin panel using a firewall or infrastructure-level authentication mechanisms.

Dcat Admin version 2.2.3-beta and all earlier versions.