The vulnerability identified as CVE-2025-49253 affects thembay Lasa versions up to 1.1. It arises from improper control of the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or remediation information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, which may result in disclosure of sensitive information, code execution, and full system compromise. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations, disabling or restricting PHP include/require functionality where possible, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing vulnerable versions publicly.