The vulnerability CVE-2025-22364 affects the Service Shogun Ach Invoice App up to version 1.0.1. It arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files within the application context, potentially leading to full compromise of the affected system. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in unauthorized disclosure of sensitive information, execution of arbitrary code, and disruption of service within the affected Ach Invoice App. This compromises the confidentiality, integrity, and availability of the system running the vulnerable software.

No official patch or remediation information is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the affected application and applying strict input validation or web application firewall rules to block malicious include parameters may reduce risk. Avoid exposing the application to untrusted networks where possible.