The vulnerability CVE-2025-26757 affects FULL SERVICES FULL Customer software (versions up to 3.1.26) and is caused by improper control over filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can allow attackers to execute arbitrary code or access sensitive files by including unintended local files. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion via PHP include/require statements. This can allow attackers to execute arbitrary code or access sensitive data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as restricting file inclusion paths or disabling remote file inclusion in PHP configurations if applicable. Avoid exposing vulnerable versions to untrusted users. Monitor vendor channels for updates.