The vulnerability CVE-2025-23945 affects Webliup Popliup versions up to 1.1.1 and is characterized by improper control over the filename parameter in PHP include or require statements. This weakness leads to PHP Local File Inclusion, which can allow an attacker with limited privileges to include and execute arbitrary local files within the application context. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to arbitrary code execution, disclosure of sensitive information, and potential full compromise of the affected system. The high CVSS score reflects the critical nature of these impacts. However, there are no reports of active exploitation in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Since the vendor has not provided an advisory or fix, users should monitor official Webliup communications for updates. In the meantime, restrict network access to affected instances and review application configurations to limit exposure to untrusted input in include/require statements.