The vulnerability CVE-2025-32289 in ApusTheme Yozi is due to improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially executing arbitrary code or accessing sensitive files on the server. The issue affects Yozi versions up to 2.0.63. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, leading to disclosure of sensitive information, code execution, or denial of service. The impact is rated high due to the potential for full system compromise. However, the attack complexity is high, which may limit exploitation scenarios. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall (WAF) rules to detect and block suspicious include requests, and monitoring for unusual file access patterns. Avoid exposing the affected theme on publicly accessible servers if possible. Follow vendor communications closely for updates on patches or official mitigations.