The vulnerability CVE-2025-25174 affects the beeteam368 BeeTeam368 Extensions (versions up to 1.9.4) and involves improper control of the filename parameter in PHP include or require statements. This weakness allows an attacker to perform PHP Local File Inclusion, which can lead to remote code execution or other severe impacts. The CVSS 3.1 score of 10.0 reflects the critical nature of this vulnerability, with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability was published on 2025-08-14, but no official patch or mitigation guidance has been provided.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to remote code execution, full system compromise, and complete loss of confidentiality, integrity, and availability of the affected system. Given the CVSS score of 10.0, the impact is critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable BeeTeam368 Extensions or applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates.