This vulnerability (CVE-2025-58952) involves improper control of filenames used in include or require statements in PHP within ThemeREX Neuronet, classified under CWE-98. It allows unauthenticated attackers to perform local file inclusion on Neuronet versions before 1.14.0. The CVSS 3.1 score is 8.1, indicating high impact with network attack vector, high confidentiality, integrity, and availability impact, but requiring high attack complexity and no privileges or user interaction. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, and full system compromise. The high CVSS score reflects the critical confidentiality, integrity, and availability impacts possible through this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted inputs that could influence file inclusion.