The vulnerability CVE-2025-52729 affects thembay Diza through improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker to include files on the server that should not be accessible, potentially leading to remote code execution or data disclosure. The affected versions include all versions up to and including 1.3.9. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing unauthorized file inclusion. This can result in disclosure of sensitive information, execution of arbitrary code, or denial of service. No known exploits are reported in the wild, but the high CVSS score reflects the potential severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions of thembay Diza and applying any recommended temporary mitigations from the vendor. Monitor official thembay channels for updates and patches addressing this vulnerability.