This vulnerability (CVE-2025-47627) in LCweb PrivateContent - Mail Actions is classified under CWE-98, indicating improper control of filenames in PHP include/require statements. It allows PHP Local File Inclusion, which can lead to execution of arbitrary local files within the affected application. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and user interaction. The affected versions include all versions up to 2.3.2. There is no indication of a patch or vendor advisory at this time.

Successful exploitation can lead to local file inclusion, which may allow an attacker to execute arbitrary code or access sensitive files on the affected system. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with this component and consider restricting access or applying temporary mitigations if possible. Monitor vendor channels for updates.