SimplePie versions up to and including 1.9.0 contain a flaw that allows an attacker to induce the library to read files on the host machine. By supplying a file:// URL in an HTTP redirect or autodiscovery feed link, the vulnerable code path executes file_get_contents() on the supplied path, exposing any file the web server process can read. The issue is identified as CWE-73, a classic local file read weakness, which can lead to disclosure of configuration files, source code, or other sensitive data stored on the server.

The affected product is SimplePie, the PHP library used to parse RSS/Atom feeds. All releases up to 1.9.0 are impacted; newer releases beyond 1.9.0 are presumed fixed.

The CVSS score of 8.2 indicates a high severity vulnerability. The EPSS score is reported as less than 1%, suggesting a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog at present. An attacker would need to control or manipulate a feed source that the vulnerable application consumes. By returning a redirect or feed link to a file:// path, the attacker can read arbitrary files accessible to the web server process. Once the application performs the read, the attacker can retrieve the file contents through the normal response channel. The attack vector is remote via HTTP responses processed by the SimplePie library.