The vulnerability CVE-2025-49257 affects thembay Zota versions up to 1.3.8 and is characterized by improper control of filenames used in PHP include or require statements. This weakness can lead to PHP Local File Inclusion, where an attacker might include unauthorized files on the server, potentially resulting in code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server running thembay Zota, leading to arbitrary code execution, data leakage, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.