The vulnerability CVE-2025-39462 affects teamzt Smart Agreements through improper control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, where an attacker may cause the application to include unintended files. The affected versions are up to and including 1.0.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score reflects the serious impact on confidentiality, integrity, and availability of the affected system. However, no known active exploits have been reported.

No official patch or remediation is currently available for this vulnerability. Users of teamzt Smart Agreements should monitor the vendor's advisories for updates. Until a fix is released, consider restricting access to the affected application and applying any available workarounds recommended by the vendor. Avoid exposing the application to untrusted users or networks.