The vulnerability CVE-2025-30582 affects aytechnet DyaPress ERP/CRM through version 18.0.2.0. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks that result in PHP Local File Inclusion. This can allow an unauthenticated remote attacker to include arbitrary local files, potentially leading to full system compromise. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application data, and disruption of service. The attacker can execute arbitrary PHP code by including local files, which may result in complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is available at this time. Users should monitor vendor communications for updates and apply any released fixes promptly.