The vulnerability CVE-2025-67530 affects the thembay Besa PHP program up to version 2.3.15. It arises from improper control of the filename parameter used in include or require statements, leading to PHP Local File Inclusion. This can allow an attacker with low privileges to include unintended files, potentially resulting in remote code execution or information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor thembay's official channels for updates. In the meantime, restricting access to the affected application and limiting privileges may reduce risk.