The vulnerability identified as CVE-2025-49297 affects the Mikado-Themes Grill and Chow product through a path traversal flaw involving the sequence '.../...//'. This flaw enables PHP Local File Inclusion, potentially allowing an attacker to include and execute arbitrary local files. The affected versions are up to and including 1.6. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor patch or mitigation details are currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform local file inclusion via PHP, potentially leading to disclosure of sensitive information, code execution, and disruption of service. The high CVSS score indicates a serious risk to affected systems. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected installations and monitor for unusual activity related to file inclusion attempts. Avoid exposing vulnerable endpoints to untrusted networks where possible.