The vulnerability CVE-2025-49259 affects thembay Hara versions up to 1.2.10 and is characterized by improper control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, which can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and applying general PHP security best practices relevant to file inclusion vulnerabilities. Monitor official thembay channels for updates or patches addressing this issue.