The vulnerability CVE-2025-49255 affects thembay Ruza versions up to 1.0.7 and is caused by improper control of the filename parameter used in PHP include or require statements. This allows an attacker to perform PHP Local File Inclusion, potentially enabling execution of arbitrary code or disclosure of sensitive files. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges or user interaction, and impacts confidentiality, integrity, and availability at a high level. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary PHP code, access sensitive files, or disrupt service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable include/require functionality if possible or apply other PHP hardening measures specific to file inclusion vulnerabilities. Monitor vendor channels for updates.