The vulnerability CVE-2025-25172 affects beeteam368 VidMov (versions up to 1.9.4) and is caused by improper control of the filename parameter in PHP include/require statements. This flaw allows PHP Local File Inclusion, where an attacker can cause the application to include unintended local files, potentially leading to code execution or information disclosure. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute local files on the affected server, potentially leading to full compromise of confidentiality, integrity, and availability of the system running VidMov. This can result in unauthorized access to sensitive data, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect and block file inclusion attempts, and reviewing application configurations to limit file inclusion paths where possible.