CVE-2025-28991 describes a vulnerability in the snstheme Evon product where improper control of the filename parameter in PHP include or require statements allows local file inclusion. This can enable an attacker to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The affected versions are up to 3.4. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, unauthorized code execution, and disruption of service on affected systems running snstheme Evon up to version 3.4. The high CVSS score reflects the significant risk posed by this flaw if exploited remotely without authentication.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and consider applying any future patches promptly. Until a fix is released, restricting access to vulnerable endpoints and employing web application firewalls to detect and block suspicious include/require requests may help mitigate risk.