CVE-2025-49264 describes a PHP Local File Inclusion vulnerability in the Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login product (versions up to 1.0.18). The issue arises from improper control of the filename parameter used in include/require statements within the PHP code. This flaw can be exploited remotely over the network with user interaction and high attack complexity, potentially allowing an attacker to execute arbitrary code or access sensitive files. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No vendor patch or official remediation details are currently available.

Successful exploitation of this vulnerability could lead to unauthorized inclusion of local files in the PHP application, potentially enabling disclosure of sensitive information, code execution, or denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability. No known active exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable component and monitor for updates from the vendor. Avoid exposing the affected service to untrusted networks and users if possible.