The vulnerability CVE-2025-47474 affects Ninetheme Anarkali through improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information or remote code execution. The issue affects Anarkali versions up to and including 1.0.9. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may read sensitive files or execute arbitrary code, depending on the server configuration and included files. The high CVSS score underscores the critical nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor once available.