The vulnerability CVE-2025-22656 in Oscar Alvarez Cookie Monster arises from improper validation of filenames used in PHP include/require statements. This allows an attacker to perform Local File Inclusion, which can lead to arbitrary file disclosure or code execution depending on the environment. The affected versions include all versions up to 1.2.2. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of LFI vulnerabilities, the impact is significant for affected deployments.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, avoid exposing vulnerable versions to untrusted networks and consider applying temporary mitigations such as disabling vulnerable functionality or restricting file inclusion paths if possible.