The vulnerability CVE-2025-52815 affects AncoraThemes CityGov (<= 1.9) and is characterized by improper control over the filename parameter used in PHP include or require statements. This flaw enables PHP Local File Inclusion, where an attacker can manipulate the filename to include unintended local files on the server. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability was published on 2025-06-27 and is tracked by Patchstack. There is no information about known exploits in the wild or vendor-provided patches.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor AncoraThemes communications for updates. Until a fix is available, restricting access to the vulnerable application and applying web application firewall rules to block suspicious include/require requests may help mitigate risk.