The vulnerability CVE-2025-48171 affects thembay Cena Store (up to version 2.11.26) and is caused by improper control over the filename parameter used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, which can be exploited remotely over the network without authentication but requires high attack complexity. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates no privileges or user interaction are needed, but the attack complexity is high. No patch or official remediation details are currently provided.

Exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, disclosure of sensitive information, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require requests, and limiting file permissions to reduce potential impact.