The vulnerability identified as CVE-2025-52805 affects VaultDweller Leyka versions up to and including 3.32.1. It involves a path traversal flaw using the sequence '.../...//' which leads to PHP local file inclusion. This can allow an attacker to include and execute arbitrary files on the server, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker who can trick a user into interacting with a crafted link or input to include arbitrary files on the server. This can lead to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider restricting access to vulnerable versions. Monitor vendor communications for updates on patches or official mitigations.