CVE-2025-39475 is a path traversal vulnerability in Frenify Arlo (<= 6.0.3) that enables PHP Local File Inclusion via the '.../...//' sequence. This allows an unauthenticated remote attacker to access and potentially execute arbitrary files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1, reflecting high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected Frenify Arlo system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks if possible.