The vulnerability identified as CVE-2025-49994 affects the ovatheme Athens product through improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include local files on the server. The affected versions are up to and including 1.1.6. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests related to file inclusion.