The vulnerability CVE-2025-49436 affects CocoBasic Anotte versions up to 1.8 and is caused by improper validation or control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, allowing an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability with high severity.

Successful exploitation of this vulnerability can lead to an attacker executing arbitrary local files on the server hosting CocoBasic Anotte, potentially resulting in full system compromise including data disclosure, modification, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — no official patches or vendor advisories are currently available. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, restricting access to the affected application and applying web application firewall rules to block suspicious include/require requests may help reduce risk.