CVE-2026-111234: SimplePie through 1.9.0 Local File Read via file:// Redirect
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents() to read files accessible to the web server process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SimplePie through version 1.9.0 to retrieve feeds from malicious or untrusted feed servers are exposed. The impact is limited to files that the web server process can read.
What does an attacker need to exploit it?
An attacker needs to control a feed server or otherwise cause the application to fetch an attacker-controlled feed. They can provide a file:// target in an HTTP Location redirect or a feed autodiscovery link.
Is authentication or user interaction required?
No authentication or user interaction is required according to the supplied vector. Exploitation requires a high-complexity attack involving the application's feed-fetching behavior and a malicious feed response.
How can I tell whether my deployment may be affected?
Review whether SimplePie version 1.9.0 or earlier is in use and whether it fetches feeds from sources that could be malicious. Check feed retrieval logs or configurations for redirects or autodiscovery links targeting file:// paths.