The vulnerability CVE-2025-64363 involves improper control of the filename parameter used in PHP include or require statements within the SeventhQueen Kleo product. This results in a Local File Inclusion vulnerability that can be exploited to include unintended files on the server. The issue affects all versions of Kleo before 5.5.0. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.