The vulnerability CVE-2025-64205 affects TieLabs Jannah versions up to 7.6.0 and is characterized by improper control over the filename parameter in PHP include or require statements. This improper control can lead to PHP Local File Inclusion, allowing an attacker to include and execute local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The vulnerability was published on December 18, 2025, and no official patch or mitigation guidance has been disclosed yet.

Successful exploitation of this vulnerability can result in local file inclusion, which may allow an attacker to execute arbitrary code, disclose sensitive information, or disrupt service on affected TieLabs Jannah installations. The impact is rated high due to the potential for full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable components and review configurations to limit exposure. Avoid exposing the affected application to untrusted networks where possible.