The vulnerability CVE-2025-14431 affects THEMELOGI Navian versions up to 1.5.4 and is caused by improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion vulnerability. This flaw allows an attacker to include arbitrary local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute local files on the server. This can result in unauthorized access to sensitive data, execution of arbitrary code, or service disruption. The CVSS score of 8.1 confirms the high severity and potential critical impact of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect and block file inclusion attempts, and reviewing server configurations to limit file inclusion risks. Avoid exposing the affected application to untrusted networks if possible.