The vulnerability CVE-2025-58215 affects the gavias Ziston product before version 1.4.5. It arises from improper control of the filename parameter used in PHP include or require statements, which leads to a Local File Inclusion (LFI) vulnerability. This allows an unauthenticated remote attacker to include files from the local filesystem, potentially executing arbitrary code or accessing sensitive information. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, impacting confidentiality, integrity, and availability at a high level. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability could allow an attacker to read or execute arbitrary local files on the server running the vulnerable Ziston application. This can lead to disclosure of sensitive information, code execution, and full system compromise. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application, applying web application firewalls with rules to detect and block LFI attempts, and reviewing application configurations to limit file inclusion paths. Avoid exposing the application to untrusted networks if possible.