On October 20, TWCERT/CC published TVN-202610004: ArmorX Global Technology's ArmorX Spam contains a local file inclusion vulnerability (CVE-2026-113402) and a command injection vulnerability (CVE-2026-113403), each with a CVSS v4.0 score of 7.1, allowing authenticated remote attackers to load PHP files outside the intended directory or upload malicious code [1]. Update to version 8.15.2-3.282.133-1.90.061 or later [1].
ArmorX Spam Contains Local File Inclusion and Command Injection Vulnerabilities (CVE-2026-113402, CVE-2026-113403)
1 min read
- Disclosed
- Oct 20, 2026
- Published
- Nov 7, 2026
- Last updated
- Nov 6, 2026
- CVSS basis
- [1]
- 0.7%, higher than 55% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Vulnerability status
- Language / package ecosystem
On this page
30-second summary
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| 鎧睿全球科技 ArmorX Spam | < 8.15.2-3.282.133-1.90.061[1] | 8.15.2-3.282.133-1.90.061 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- TWCERT/CC publishes TVN vulnerability advisory; patched version released[1]
Technical details
Vulnerability Details
Both vulnerabilities require an authenticated remote attacker: CVE-2026-113402 is a path traversal issue leading to local file inclusion, and CVE-2026-113403 is a command injection flaw, affecting versions prior to 8.15.2-3.282.133-1.90.061 [1]. Both were reported by researchers at DEVCORE [1].
Remediation
Vendor guidance
- 1Update to 8.15.2-3.282.133-1.90.061 patch[1]
References
Official / primary1
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.