CVE-2025-31064 is a PHP Remote File Inclusion vulnerability in the gavias Vizeon - Business Consulting product, affecting versions before 1.2.1. The vulnerability arises from improper control over filenames used in include or require statements, allowing remote attackers to execute arbitrary code by including malicious remote files. The CVSS 3.1 base score is 8.1, reflecting high confidentiality, integrity, and availability impacts, with an attack vector over the network and no required privileges or user interaction. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to fully compromise the affected system's confidentiality, integrity, and availability. This could result in unauthorized access, data theft, data modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure by restricting network access to the vulnerable application, disabling or restricting the use of include/require functionality if possible, and monitoring for suspicious activity related to file inclusion attempts.