The vulnerability CVE-2025-52808 affects RealtyElite by real-web and is characterized by improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This allows an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue affects versions up to and including 1.0.0. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files on the server running RealtyElite. Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, the impact is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules targeting file inclusion attempts, and monitoring for suspicious activity related to file inclusion. Avoid exposing the affected application to untrusted networks if possible.