The vulnerability CVE-2025-49886 affects WebGeniusLab Zikzag Core versions up to 1.4.5 and is caused by improper validation or control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, allowing an attacker to include and execute arbitrary files on the server. The CVSS 3.1 vector indicates the attack requires network access, has high attack complexity, no privileges or user interaction needed, and impacts confidentiality, integrity, and availability at a high level. No vendor patch or mitigation details are currently available.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The impact is rated high due to the potential for full system compromise. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls to detect and block suspicious requests, and monitoring for unusual activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.