The vulnerability CVE-2025-26748 affects looswebstudio Arkhe versions up to 3.12.0 and is characterized as a Cross-Site Request Forgery (CSRF) issue that enables PHP Local File Inclusion. This means an attacker could potentially trick a user into executing unauthorized actions that include local files on the server, leading to high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.1, reflecting a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server via CSRF, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting file inclusion functionality if possible. Monitor vendor channels for updates.