This vulnerability, identified as CVE-2025-58924, affects Geya versions up to 1.15 and is caused by improper control of filenames used in PHP include or require statements, leading to unauthenticated local file inclusion. The CVSS 3.1 score of 8.1 indicates high impact with network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to arbitrary code execution, full compromise of confidentiality, integrity, and availability of the affected system. This poses a significant risk to systems running vulnerable versions of Geya.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations, applying web application firewalls with rules targeting LFI attempts, and monitoring for suspicious activity related to file inclusion attempts.