# CVE-2025-67174: A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via…

Source: https://junglewise.ai/threats/cve-2025-67174-a-local-file-inclusion-lfi-vulnerability-in-ritecms-v3-1-0-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-17  
License: CC BY 4.0 with a link back

CVE-2025-67174 · Severity: high · CVSS 7.5 · Published 2025-12-17

A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component

Technologies: [Ritecms](https://junglewise.ai/threats/technologies/ritecms). Vendors: [Ritecms](https://junglewise.ai/threats/vendors/ritecms).

## Quick answers

**Is CVE-2025-67174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67174 being exploited in the wild.

**How severe is CVE-2025-67174?** High severity, with a CVSS score of 7.5, published 17 December 2025.

**Which products and versions are affected?** Ritecms. The advisory does not name versions.

**Is there a fix for CVE-2025-67174?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-67174?** Check whether you run Ritecms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Ritecms

## Related threats

- [A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to…](https://junglewise.ai/threats/cve-2025-67173-a-cross-site-request-forgery-csrf-in-the-page-creation-editing)
- [Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.](https://junglewise.ai/threats/cve-2025-67171-incorrect-access-control-in-the-templates-component-of-ritecms-v3)
- [RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.](https://junglewise.ai/threats/cve-2025-67168-ritecms-v3-1-0-was-discovered-to-use-insecure-encryption-to-store)
- [RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.](https://junglewise.ai/threats/cve-2025-67172-ritecms-v3-1-0-was-discovered-to-contain-an-authenticated-remote)