The vulnerability CVE-2025-49883 affects thembay Greenmart versions up to 4.2.3 and arises from improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include and execute local files on the server, potentially leading to full system compromise. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected Greenmart installations. The high CVSS score reflects the critical nature of these impacts. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable Greenmart installations and review PHP include/require usage to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.