CVE-2025-49260 is a vulnerability in thembay Aora (versions ≤ 1.3.9) caused by improper control of filenames in PHP include/require statements, enabling remote file inclusion. This allows attackers to execute arbitrary code remotely by including malicious files. The vulnerability is exploitable over the network without authentication or user interaction, but requires high attack complexity. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available from the vendor or public advisories.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to fully compromise the affected system's confidentiality, integrity, and availability. This can result in unauthorized access, data theft, system manipulation, or denial of service. Given the high CVSS score and the nature of remote file inclusion, the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable include/require functionality if possible, and avoid exposing the affected application to untrusted networks. Monitor official thembay communications for updates and patches addressing this vulnerability.