The vulnerability CVE-2025-49892 affects uxper Uxper Booking versions up to 1.3.3 and is caused by improper validation of filenames used in PHP include or require statements. This improper control can lead to Local File Inclusion (LFI), enabling an attacker to include and execute arbitrary files on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and full system compromise. The high CVSS score reflects the critical nature of these impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP configurations, or applying web application firewall rules to detect and block suspicious requests. Monitor vendor channels for updates and patches.