CVE-2025-48160 describes a PHP Local File Inclusion vulnerability in CocoBasic Caliris (up to version 1.5) caused by improper validation of filenames used in include/require statements. This allows an attacker to manipulate the filename parameter to include unintended local files, which can lead to disclosure of sensitive data or execution of malicious code within the context of the web server. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The CVSS 3.1 vector indicates no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive local files, unauthorized code execution, and potential full compromise of the affected web application and underlying server. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor CocoBasic's communications for updates. Until a fix is available, restricting access to vulnerable endpoints and employing web application firewalls to detect and block suspicious include/require parameter manipulations may help mitigate risk.