CVE-2025-24761 describes a PHP Local File Inclusion vulnerability in the snstheme DSK product versions before 2.4. The vulnerability arises from improper control of filenames used in include or require statements within PHP code, allowing an attacker to include local files arbitrarily. This can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. There is no vendor advisory or patch information currently available, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of system files, and disruption of service on affected installations of snstheme DSK prior to version 2.4. The attacker can leverage the Local File Inclusion flaw to execute arbitrary local code or access sensitive files, severely impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.