The vulnerability CVE-2025-49942 affects AncoraThemes Gardis up to version 1.2.13 and is caused by improper validation of filenames used in PHP include or require statements. This can lead to Local File Inclusion (LFI), where an attacker can cause the application to load unintended local files. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow an attacker to read sensitive files on the server, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is considered severe. However, no known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality if possible. Monitor official AncoraThemes channels for updates and apply patches promptly once released.