The vulnerability CVE-2025-27362 affects BZOTheme Petito versions before 1.6.6 and involves improper control over filenames used in PHP include or require statements. This can lead to PHP Local File Inclusion, where an attacker may cause the application to include unintended files, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1 with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in an attacker including local files on the server, which may lead to arbitrary code execution, data disclosure, or denial of service. The high CVSS score reflects the critical nature of these impacts. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of affected versions should monitor BZOTheme communications for updates and consider applying any forthcoming patches promptly. Until a fix is available, restricting access to the affected application and limiting file inclusion capabilities at the server configuration level may reduce risk.