This vulnerability (CVE-2025-60085) is classified under CWE-98, indicating improper control of filenames for include/require statements in PHP programs, commonly known as PHP Remote File Inclusion or Local File Inclusion. Specifically, Learnify versions up to 1.15.0 are affected by an unauthenticated Local File Inclusion vulnerability. An attacker can exploit this flaw without authentication, potentially including arbitrary local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No patch or official remediation is currently documented or linked by the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker may read sensitive files, execute arbitrary code, or cause denial of service by including malicious or unintended files. The vulnerability is exploitable remotely without authentication, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider applying temporary mitigations such as disabling vulnerable functionality or restricting access to affected endpoints if possible.