The vulnerability CVE-2025-28916 affects Rashid Docpro (<= 2.0.1) and is caused by improper control of filenames in PHP include/require statements, enabling Local File Inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector and no required privileges or user interaction. No official patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files, potentially leading to complete system takeover. The critical CVSS score of 9.8 reflects the severity and ease of exploitation over the network without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable PHP include/require functionality if possible, and monitor for any updates from Rashid regarding patches or mitigations.