CVE-2025-54690 affects themeStek Xinterio versions up to 4.2 and is caused by improper validation or control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, where an attacker can cause the application to include unintended local files. The vulnerability has a CVSS 3.1 score of 8.1, reflecting high impact on confidentiality, integrity, and availability, with an attack vector over the network and no privileges or user interaction required. No patch or mitigation details are currently provided by the vendor or in public advisories.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is significant. However, no known exploits have been reported in the wild as of now.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to vulnerable installations and consider disabling or restricting the affected functionality if possible. Monitor themeStek advisories for updates and apply patches promptly once released.