The vulnerability CVE-2025-31060 affects ApusTheme Capie up to version 1.0.40 and is caused by improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may be able to execute arbitrary code or access sensitive files on the server hosting ApusTheme Capie. This poses a significant security risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality or applying temporary mitigations if documented by the vendor. Monitor official ApusTheme channels for updates.