The vulnerability CVE-2025-60193 in Premmerce User Roles (<= 1.0.13) is caused by improper validation or control of filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, where an attacker can cause the application to include unintended local files, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the server running Premmerce User Roles, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized access to sensitive data, code execution, or denial of service. However, no known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Premmerce's official channels for updates. Until a fix is available, consider restricting access to the affected application and applying any available workarounds recommended by the vendor.