The vulnerability CVE-2025-67936 in Mikado-Themes Curly arises from improper control of filenames used in PHP include or require statements, enabling local file inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue affects Curly versions before 3.3. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker may execute arbitrary code or disclose sensitive files on the server running the vulnerable Curly version. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor Mikado-Themes advisories for updates and consider restricting access to vulnerable installations until a fix is released.