The vulnerability CVE-2025-32286 in ApusTheme Butcher arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), where arbitrary local files on the server can be included and executed within the PHP context. The affected versions include all releases up to and including 2.40. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, but requires high attack complexity. The impact includes full compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation information is currently available, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, and potentially take full control over the affected system. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected ApusTheme Butcher versions or applying manual code review and hardening to prevent file inclusion. Monitor vendor channels for updates and patches.