CVE-2025-27015 is a vulnerability in designingmedia Hostiko (versions before 30.1) caused by improper control of filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, enabling an attacker with low privileges to include unintended local files. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been reported.

The vulnerability allows an attacker to include local files via PHP include/require statements improperly controlled by the application. This can lead to disclosure of sensitive information, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability. The CVSS score of 7.5 reflects a high severity impact. No known exploits in the wild have been reported, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for vendor updates addressing this vulnerability. Until a patch is available, restricting access to vulnerable endpoints and applying application-level controls to validate or sanitize input used in include/require statements may help reduce risk.