The Dahz Kitring product (versions up to 2.8) contains a vulnerability identified as CVE-2025-49426, characterized by improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include and execute unauthorized files on the server. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The impact includes high confidentiality, integrity, and availability loss. As of now, no patch or vendor advisory is available to confirm remediation status.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code or access sensitive files on the affected server, leading to full compromise of the system's confidentiality, integrity, and availability. The CVSS score of 8.1 reflects a high impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable components, applying web application firewalls to detect and block suspicious include/require requests, and following best practices to limit PHP file inclusion risks. Monitor Dahz vendor communications for updates and apply patches promptly once available.