CVE-2026-51925: Local File Inclusion in docuForm GmbH Client 11.11c

Technical summary

CVE-2026-51925 is a Local File Inclusion (LFI) vulnerability in the dfm-menu_report.php component of docuForm GmbH Client 11.11c. The vulnerability stems from insufficient input validation (CWE-639), permitting an authenticated attacker to inject file paths and retrieve arbitrary files from the server filesystem. The CVSS 3.1 score of 8.1 (HIGH) reflects that while authentication is required, the impact to confidentiality and integrity is substantial. The attack vector is network-based and does not require user interaction.

Business impact

Organizations using docuForm GmbH Client 11.11c face exposure of confidential business information, system architecture details, and credentials stored in configuration files. In healthcare, legal, or financial sectors where docuForm may process sensitive documents, a successful exploitation could result in regulatory violations (HIPAA, GDPR, PCI-DSS), reputational damage, and potential data breach notification costs. The ability to read arbitrary files also increases the likelihood of a follow-on attack using disclosed system or application details.

Affected systems

docuForm GmbH Client version 11.11c is affected. Organizations should audit their deployments to confirm the exact version in use. The vulnerability requires network access and valid authentication credentials, so risk is highest in environments where user accounts have been compromised or where internal users may be social engineered.

Exploitability

The vulnerability is exploitable by any authenticated user without requiring additional privilege escalation. No special tools or techniques are needed beyond knowledge of the vulnerable component path (dfm-menu_report.php) and the ability to craft a malicious file inclusion request. The barrier to exploitation is low once credentials are obtained, though the initial compromise of a user account is a prerequisite.

Remediation

Organizations must immediately update docuForm GmbH Client to a patched version. Contact docuForm GmbH directly or consult their security advisory for the specific build that resolves CVE-2026-51925. Until patching is possible, restrict network access to the dfm-menu_report.php component using a Web Application Firewall (WAF) or access control lists, and monitor for suspicious file inclusion patterns in application logs.

Patch guidance

Upgrade docuForm GmbH Client beyond version 11.11c to a version that includes the security fix—verify the specific patched version number against the vendor's official security advisory or support portal. Test the patch in a non-production environment to confirm functionality and compatibility with your application integrations before rolling out to production. After patching, verify that the dfm-menu_report.php component no longer accepts arbitrary file paths.

Detection guidance

Monitor web server and application logs for requests to dfm-menu_report.php that contain file path traversal sequences (e.g., ../, .., double-encoding, or null byte injection). Alert on authentication successes followed by unusual file access patterns. Use a WAF to log and potentially block requests containing path traversal indicators. Perform regular file integrity monitoring on sensitive configuration files to detect unauthorized read access.

Why prioritize this

This vulnerability merits high priority due to its direct exposure of sensitive files and credentials, the ease of exploitation once authenticated, and the wide range of follow-on attacks it enables. Organizations should treat it as urgent in environments where user account compromise is plausible or where docuForm Client processes or stores regulated data.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a HIGH severity rating. The score is driven by high impact to confidentiality (C:H) and integrity (I:H)—attackers can read and potentially manipulate sensitive files. The requirement for prior authentication (PR:L) and lack of availability impact (A:N) prevent the score from reaching CRITICAL, but the network attack vector (AV:N) and low attack complexity (AC:L) ensure the vulnerability remains highly exploitable within its threat model.

Frequently asked questions