The vulnerability CVE-2025-31014 affects Hossein Material Dashboard through improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker with low privileges to include and execute local files, potentially leading to remote code execution or data disclosure. The issue impacts versions up to 1.4.5. The CVSS 3.1 base score is 7.5, with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, unauthorized code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The attacker requires only low privileges and no user interaction, making this a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application, applying web application firewall rules to detect and block suspicious include requests, and reviewing application configurations to limit file inclusion paths. Monitor vendor channels for updates and apply patches promptly once released.