The vulnerability identified as CVE-2025-49251 affects the thembay Fana PHP application through improper control of filenames in include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and execute files on the server. The affected versions are up to and including 1.1.28. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and exploitation in the wild is not known.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS vector indicates network attack vector with high complexity and no privileges or user interaction required, resulting in high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to affected systems and review application configurations to limit file inclusion risks. Monitor official thembay advisories for updates and apply patches promptly once available.