The vulnerability CVE-2025-67925 in zozothemes Corpkit arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files, code execution, or denial of service. The affected versions include all versions up to 2.0. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized modification of data, and disruption of service in the affected Corpkit installations. The attacker can include local files on the server, potentially leading to remote code execution or system compromise. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is available at this time. Until a patch is released, users should consider restricting access to vulnerable Corpkit installations and review PHP configuration to limit file inclusion risks. Monitor vendor channels for updates and apply official fixes once available.