CVE-2025-5804 is a vulnerability classified under CWE-98, involving improper control of filenames used in PHP include or require statements within the Case Themes Case Theme User product. This flaw allows PHP Local File Inclusion, which can enable attackers to include and execute local files on the affected system. The vulnerability affects versions prior to 1.0.4. The CVSS 3.1 base score is 7.5, reflecting high impact with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the current data. The product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server running the vulnerable Case Theme User product. This may lead to disclosure of sensitive information, code execution, or other impacts affecting confidentiality, integrity, and availability. The CVSS score of 7.5 indicates a high impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Case Themes advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor if published.