The vulnerability CVE-2025-54716 in ovatheme Ireca (<= 1.8.5) is caused by improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can manipulate the filename to include arbitrary files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full system compromise including disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, the attack complexity is high, which may limit exploitability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect suspicious include/require requests, and reviewing server file permissions to limit exposure. Monitor official ovatheme communications for updates and apply patches promptly once available.