The vulnerability CVE-2025-52814 affects the ovatheme BRW PHP application through improper validation of filenames used in include or require statements. This improper control enables PHP Local File Inclusion, where an attacker can trick the application into including unintended local files. This can lead to disclosure of sensitive information, code execution, or denial of service. The issue impacts BRW versions up to 1.8.7. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files on the server by exploiting the local file inclusion flaw. This could lead to data breaches, system takeover, or service disruption. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing temporary mitigations such as disabling vulnerable functionality if possible or restricting file inclusion paths via configuration. Monitoring vendor communications for patches or updates is critical.