The vulnerability CVE-2025-32294 in gavias Oxpitan (<= 1.3.5) is due to improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion issue. This allows an attacker to include local files on the server, which can lead to sensitive data exposure or code execution depending on the context. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network attack vector with high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official fix details are available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include arbitrary local files on the server running Oxpitan, potentially leading to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests if possible.