The vulnerability CVE-2025-32595 affects gavias Krowd versions before 1.5.0 and is characterized by improper control over filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, where an attacker can manipulate the filename parameter to include unintended files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service on the affected system. The impact covers confidentiality, integrity, and availability, all rated high. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP hardening measures relevant to file inclusion vulnerabilities. Monitor vendor channels for updates and apply patches promptly once released.