The vulnerability CVE-2025-59555 affects ThemeMove's Medizin product prior to version 1.9.7. It is caused by improper validation or control of filenames used in PHP include or require statements, which can lead to Local File Inclusion (LFI). This allows an attacker to include and execute arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files by including unauthorized local files via the vulnerable PHP include/require mechanism. This poses a significant risk to systems running vulnerable versions of ThemeMove Medizin prior to 1.9.7. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor ThemeMove's official channels for updates. In the meantime, restricting access to vulnerable installations and applying web application firewall rules to block suspicious include/require requests may reduce exposure.