The vulnerability CVE-2025-48157 affects Michele Giorgi Formality versions up to 1.5.9 and is caused by improper control of filenames in PHP include/require statements, leading to local file inclusion. This can allow an unauthenticated attacker to include and execute arbitrary files on the server, potentially compromising the system. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score indicates that the impact on confidentiality, integrity, and availability is severe. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as disabling vulnerable functionality or restricting access to affected components. Monitor official channels for updates from Michele Giorgi regarding patches or mitigations.