The vulnerability CVE-2025-39490 in Mikado-Themes Backpack Traveler arises from improper validation or control of filenames used in PHP include or require statements. This leads to a Local File Inclusion (LFI) vulnerability, where an attacker can trick the application into including arbitrary files from the server. The affected versions are up to 2.10.2. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, but requires high attack complexity. The impact includes high confidentiality, integrity, and availability loss. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions and applying any recommended temporary mitigations from the vendor. Avoid exposing the affected application to untrusted networks if possible.