Formality - LFI (CVE-2025-48157)
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.
psychologyCrowdSec Analysis
CVE-2025-48157 is a local file inclusion (LFI) vulnerability in Michele Giorgi's Formality plugin up to version 1.5.9, caused by improper control of filenames in PHP include or require statements. This flaw allows remote attackers to include and potentially execute arbitrary files on the server, which could lead to information disclosure, code execution, or further compromise of the affected system.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-48157 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending crafted requests to endpoints such as /wp-content/uploads/formality/storage/download.php with parameters like file=/etc/passwd to include arbitrary local files, often following authentication via /wp-login.php and access to /wp-admin/admin.php.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-08-20 |
| Rule Released | 2026-06-03 |
| CrowdSec First Seen | 2026-06-11 |