The vulnerability CVE-2025-64373 affects shinetheme Traveler versions before 3.2.6. It arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw can be exploited remotely over the network without privileges or user interaction, but requires high attack complexity. Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation details are provided in the available data.

If exploited, this vulnerability allows an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and system compromise. The CVSS vector indicates high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable application and applying web application firewall rules to detect and block suspicious include/require attempts may help mitigate risk.