The vulnerability CVE-2025-54689 affects thembay Urna versions up to 2.5.7 and is caused by improper control of filenames in PHP include or require statements. This leads to a Local File Inclusion (LFI) vulnerability, where an attacker can manipulate the filename parameter to include unintended local files. The CVSS 3.1 score is 8.1, reflecting high impact with network attack vector, high confidentiality, integrity, and availability impacts, and requiring no privileges or user interaction but high attack complexity. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow an attacker to read sensitive local files on the server, potentially leading to disclosure of sensitive information, code execution, or full system compromise. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as restricting access to vulnerable endpoints, disabling vulnerable functionality if possible, or employing web application firewalls to detect and block suspicious input targeting file inclusion. Monitor vendor channels for updates and apply official patches promptly once available.