This vulnerability (CVE-2025-32589) affects odude Flexi – Guest Submit through improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker to include unintended files on the server, potentially leading to remote code execution or data disclosure. The issue affects all versions up to and including 4.28. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can result in full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently, but the vulnerability poses a significant risk if leveraged by attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently available, users should monitor odude's advisories closely. Until a fix is released, consider restricting access to the affected application and applying general PHP hardening measures relevant to file inclusion vulnerabilities.