The vulnerability CVE-2025-67615 in bslthemes Myour (<= 1.5.1) arises from improper validation of filenames in PHP include/require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker to manipulate the file path to include unintended local files, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary local files within the context of the web server, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable include/require functionality or applying web application firewall rules to block malicious input targeting file inclusion. Monitor vendor channels for updates.