The vulnerability CVE-2025-39383 affects codeworkweb Xews Lite versions up to 1.0.9 and is characterized by improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion issue. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized modification of data, and disruption of service on the affected system. The attacker may execute arbitrary code by including local files, which can compromise the entire server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates.