The vulnerability CVE-2025-32668 in Rameez Iqbal Real Estate Manager arises from improper control over filenames used in PHP include or require statements. This can lead to Local File Inclusion (LFI), where an attacker can cause the application to include and execute arbitrary files on the server. The affected versions are up to 7.3. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to an attacker executing arbitrary code or accessing sensitive files on the server running the Real Estate Manager software. This compromises confidentiality, integrity, and availability of the system. Given the high CVSS score (8.1), the impact is significant, potentially allowing full system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall rules to detect and block suspicious include/require attempts, and reviewing server file permissions to limit exposure. Avoid exposing the application to untrusted networks if possible.