The vulnerability identified as CVE-2025-14359 affects brandexponents Oshine versions before 7.3.0. It is categorized under CWE-98, which involves improper control of filenames used in PHP include or require statements. This improper control can allow an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild, but the potential impact remains significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules targeting local file inclusion attempts, and reviewing application configurations to limit file inclusion capabilities. Avoid exposing the vulnerable application to untrusted networks where possible.