The identified flaw is a classic Local File Inclusion that permits authenticated remote attackers to exploit path traversal. By manipulating a request parameter, the application can include PHP files outside its intended directory. Because the included code runs within the web server context, an attacker may execute arbitrary PHP, read confidential files or otherwise compromise application integrity and confidentiality.

The affected product is ArmorX Spam from ArmorX Global Technology. All releases prior to 8.15.2-3.282.133-1.90.061 are susceptible. Applying the vendor’s update to 8.15.2-3.282.133-1.90.061 or any later revision eliminates the path traversal path that the LFI uses.

The CVSS score of 7.1 rates the vulnerability as high severity. The EPSS score is recorded as below 1%, indicating a very low probability that it is actively exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, and exploitation requires authenticated access, so the attack surface is limited. Nonetheless, given the potential for code execution, organizations should treat the issue as a significant risk until mitigation is applied.