The vulnerability CVE-2025-54034 affects Tribulant Software Newsletters (<= 4.10) and arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion, potentially executing arbitrary code or accessing sensitive files on the server. The CVSS 3.1 score of 7.5 reflects network attack vector with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and user interaction. No patch or official fix information is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected installations of Tribulant Software Newsletters. The high CVSS score indicates significant risk to confidentiality, integrity, and availability. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor official Tribulant Software channels for updates and patches addressing this vulnerability.