The vulnerability CVE-2025-64216 affects ThemeSphere SmartMag up to version 10.3.0. It arises from improper control over the filename parameter used in PHP include or require statements, leading to a PHP Local File Inclusion issue. This can allow an attacker with low privileges and no user interaction to execute arbitrary local files, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on all three security properties.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the vulnerable SmartMag version. This can lead to disclosure of sensitive information, modification of data, and disruption of service. Given the high CVSS score and impact on confidentiality, integrity, and availability, the vulnerability poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.