The vulnerability CVE-2025-26757 affects FULL SERVICES FULL Customer software through improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially exposing sensitive information or enabling further attacks. The issue impacts versions up to and including 3.1.26. No CVSS score or vendor advisory with patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to include and potentially execute local files on the server running FULL Customer software, which may lead to information disclosure or other unauthorized actions depending on the included files. However, no known exploits have been reported in the wild, and the exact impact depends on the environment and usage of the vulnerable software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application and review PHP include/require usage to prevent untrusted input from controlling file paths.