The vulnerability CVE-2025-39526 affects nicdark Hotel Booking versions up to 3.6 and is caused by improper validation of filenames used in PHP include or require statements. This can lead to Local File Inclusion (LFI), allowing an attacker to include and execute arbitrary files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No vendor patch or advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected server, potentially leading to full system compromise. Confidentiality, integrity, and availability of the system and its data are at high risk. There are no known exploits in the wild yet, but the high CVSS score indicates a serious threat if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as restricting access to vulnerable scripts, disabling PHP functions that allow file inclusion if possible, or isolating the affected system. Monitor vendor channels for updates and patches.