The vulnerability CVE-2025-32519 in Foysal Imran's IDonate application arises from improper validation of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This flaw affects all versions up to and including 2.1.18. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or vendor advisory is available at this time, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect file inclusion attempts, and reviewing application code for unsafe include/require usage. Avoid exposing the application to untrusted input in include/require statements.