CVE-2025-49508 is a high-severity Local File Inclusion (LFI) vulnerability affecting LoftOcean CozyStay versions prior to 1.7.1, caused by improper control of filenames in PHP include/require statements. Rated 8.1 HIGH on the CVSS scale, this flaw allows an unauthenticated attacker to remotely include local files on the server, potentially leading to high impact on confidentiality, integrity, and availability, despite a high attack complexity. There is currently no evidence of active exploitation, nor are public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, and its Exploit Prediction Scoring System (EPSS) score is very low, suggesting a low probability of exploitation in the near future.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| LoftOcean | CozyStay | >= 0, <= 1.7.1CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.