The vulnerability CVE-2025-49416 affects FW Gallery by Fastw3b LLC and involves improper control of filenames in PHP include/require statements, leading to PHP Local File Inclusion. This can allow an attacker to include unauthorized files on the server, potentially resulting in remote code execution or disclosure of sensitive information. The issue impacts versions up to and including 8.0.0. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No vendor patch or mitigation details are currently available.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. The CVSS vector indicates network attack vector, high complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for suspicious activity. Avoid exposing FW Gallery instances to untrusted networks where possible.