The vulnerability CVE-2025-62029 affects themesion Grevo versions up to 2.4. It arises from improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion. This can allow an attacker to execute arbitrary code remotely by including malicious files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required. No patch or official fix details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to remote code execution, full system compromise, and disruption of service. Confidentiality, integrity, and availability of the affected system are all rated as high impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the vulnerable functionality if possible, and apply strict input validation or filtering on user-supplied data used in include/require statements. Monitor official vendor channels for updates and patches.