Vulnerability Details CVE-2025-39490
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler allows PHP Local File Inclusion. This issue affects Backpack Traveler: from n/a through 2.7.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 32.9%
CVSS Severity
CVSS v3 Score 8.1
Products affected by CVE-2025-39490
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.2
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.3
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.4
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.4.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.5
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.6
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.7
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.8
-
cpe:2.3:a:qodeinteractive:backpack_traveler:1.8.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.0
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.0.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.0.2
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.10
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.10.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.10.2
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.2
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.2.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.2.2
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.3
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.3.1
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.4
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.5
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.6
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.7
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.8
-
cpe:2.3:a:qodeinteractive:backpack_traveler:2.9