The vulnerability CVE-2025-39359 affects codeworkweb CWW Portfolio versions up to 1.3.1. It stems from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include unintended files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files via local file inclusion. The vulnerability is exploitable remotely but requires user interaction and has high attack complexity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted users or networks.