The vulnerability CVE-2025-49252 affects thembay Besa versions up to 2.3.8 and is caused by improper control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion issue, which can allow attackers to include and execute local files on the server. The CVSS 3.1 score of 8.1 reflects a high-severity risk with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates that confidentiality, integrity, and availability of the affected system could be severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP configuration, or limiting access to vulnerable components. Monitor official thembay communications for updates.