The vulnerability CVE-2025-67980 in thembay Hara (versions up to 1.2.17) is caused by improper control of filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and execute arbitrary files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute arbitrary local files. This can result in unauthorized access, data disclosure, code execution, and potential system disruption. The high CVSS score (8.1) confirms the critical nature of these impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to vulnerable endpoints, apply strict input validation and sanitization on filename parameters if possible, and consider disabling or limiting PHP include/require functionality where feasible. Monitor vendor communications for updates and apply patches promptly once released.