The vulnerability CVE-2025-22509 affects TMRW-studio Atlas up to version 2.1.0 and is caused by improper control over filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary file disclosure or code execution depending on the context. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or mitigation details are currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially exposing sensitive information or enabling further code execution attacks. The impact affects confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor vendor communications for updates on patches or mitigations.