The vulnerability CVE-2025-67532 affects the thembay Hara PHP program through improper control of filenames in include/require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges to include unintended files, potentially leading to full system compromise. The affected versions include all versions up to and including 1.2.17. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or official fix details are currently available.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files via local file inclusion. The vulnerability requires network access and low privileges but no user interaction. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable version of thembay Hara to untrusted networks.