The vulnerability CVE-2025-22708 in ThemeMove Mitech arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files on the server. The issue affects Mitech versions up to 2.3.4. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the affected server, potentially leading to full compromise of the system's confidentiality, integrity, and availability. This can result in unauthorized data access, modification, or denial of service. The high CVSS score reflects the severity of these impacts. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as restricting access to vulnerable endpoints, disabling vulnerable features if possible, or implementing web application firewall rules to detect and block suspicious include/require requests. Monitor official ThemeMove communications for updates and patches.