The vulnerability CVE-2025-24760 affects goalthemes Sofass through improper control of filenames in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially resulting in code execution or disclosure of sensitive information. The issue impacts Sofass versions up to and including 1.3.4. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server running Sofass, potentially leading to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates severe impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Avoid exposing the affected Sofass installation to untrusted networks if possible.