CVE-2026-12194: PHPIPAM Path Traversal Vulnerability

CVE-2026-12194 Overview

CVE-2026-12194 is an authenticated Local File Inclusion (LFI) vulnerability in PHPIPAM, an open-source IP address management application. The flaw allows authenticated users with access to the PHPIPAM API to include and execute arbitrary PHP files present on the web server's file system. The vulnerability maps to [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). The API is not enabled by default, which limits the exposed attack surface to installations where administrators have explicitly turned it on.

Critical Impact
An authenticated API user can force the PHPIPAM application to include arbitrary local PHP files, leading to execution of unintended code paths within the web server context.

Affected Products

PHPIPAM (open-source IP address management application)
Installations with the PHPIPAM API enabled
Deployments granting API credentials to lower-trust users

Discovery Timeline

2026-07-04 - CVE-2026-12194 published to the National Vulnerability Database
2026-07-06 - Last updated in the NVD database

Technical Details for CVE-2026-12194

Vulnerability Analysis

The vulnerability is an authenticated Local File Inclusion issue reachable through the PHPIPAM API. An attacker with valid API credentials can supply a crafted parameter that the application passes into a PHP include or require construct without adequate validation. Because PHP evaluates included files as code, any .php file already present on the web server file system can be executed within the PHPIPAM request context.

Exploitation requires two preconditions: the API must be enabled on the target installation, and the attacker must hold valid API credentials. Successful exploitation does not grant remote code execution from arbitrary attacker-supplied source, but it does allow the attacker to reach code paths and functionality that the API was not intended to expose. This can be used to trigger side effects, expose sensitive data handled by other PHP scripts, or chain into further weaknesses that assume the included file is only reachable through its normal entry point.

Root Cause

The root cause is improper control of a filename passed to a PHP file inclusion function, classified as [CWE-98]. The API endpoint accepts user-controlled input and uses it to construct a path that is subsequently loaded through PHP's include mechanism, without restricting the input to an allowlist of expected values. Details of the fix are available in PHPIPAM Pull Request #4625.

Attack Vector

The attack vector is network-based and requires authentication. An attacker sends a crafted HTTP request to the PHPIPAM API containing a parameter value that resolves to a PHP file on the server. When the API handler processes the request, it includes and executes the referenced file. The scope of impact is limited to files already present in the web server file system; the vulnerability does not by itself provide a mechanism to upload attacker-controlled PHP.

No public exploit code has been observed in ExploitDB, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Project Black analysis of the PHPIPAM authenticated LFI for additional context on discovery and reproduction.

Detection Methods for CVE-2026-12194

Indicators of Compromise

API requests to PHPIPAM endpoints containing path-like values, traversal sequences (../), or absolute file paths in parameters normally expecting identifiers or names.
Web server access logs showing authenticated API calls that correlate with PHP errors referencing include, require, or unexpected file paths.
Unexpected execution of PHPIPAM PHP files outside their normal request flow, visible in application or PHP-FPM logs.

Detection Strategies

Review PHPIPAM and web server logs for API requests whose parameters contain filesystem separators, .php suffixes, or references to files outside the API handler directory.
Correlate authenticated API sessions against baseline behavior and flag accounts issuing requests that touch parameters used in include operations.
Deploy signatures on a web application firewall to detect path traversal patterns and PHP filename injection targeting /api/ routes.

Monitoring Recommendations

Enable verbose logging on the PHPIPAM API and forward events to a centralized SIEM or data lake for retention and correlation.
Monitor for anomalous PHP error patterns such as failed includes, open_basedir restrictions, or file-not-found warnings originating from API request handlers.
Track API token usage per account and alert on sudden spikes in request volume or diversity of endpoints called.

How to Mitigate CVE-2026-12194

Immediate Actions Required

Upgrade PHPIPAM to a release that incorporates the fix from PHPIPAM Pull Request #4625.
Disable the PHPIPAM API on installations that do not require it, since the API is not enabled by default and disabling it removes the attack surface.
Rotate all PHPIPAM API tokens and audit which accounts hold API access, revoking tokens for users that do not need programmatic access.

Patch Information

The upstream fix is tracked in PHPIPAM Pull Request #4625, which corrects the input handling on the affected API endpoint. Administrators should update to a PHPIPAM release that includes this pull request and validate the fix by testing crafted API parameters in a staging environment.

Workarounds

Disable the PHPIPAM API entirely under application settings until the patched version is deployed.
Restrict network access to /api/ routes using a reverse proxy or web application firewall, permitting only trusted source addresses.
Configure PHP open_basedir to constrain file inclusion to the PHPIPAM application directory, limiting which files an inclusion can reach.
Enforce least privilege on PHPIPAM accounts so that API credentials are issued only to users with a documented need.

bash

# Example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/phpipam/:/tmp/"

# Example: block PHPIPAM API at the reverse proxy for untrusted networks (nginx)
location /api/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://phpipam_backend;
}