The vulnerability CVE-2025-26932 affects QuantumCloud ChatBot through improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion issue. This allows an attacker with low privileges to potentially include unintended files, impacting confidentiality, integrity, and availability of the system. The CVSS v3.1 score is 7.5, indicating a high severity with network attack vector, high complexity, no user interaction, and unchanged scope. The affected versions include all versions up to 6.3.5. No patch or vendor advisory details are provided in the input.

Successful exploitation could lead to unauthorized local file inclusion, potentially exposing sensitive data, modifying application behavior, or causing denial of service. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks or users with low privileges who could exploit this vulnerability.