The vulnerability CVE-2025-67988 affects LoftOcean CozyStay before version 1.9.1 and is caused by improper validation of filenames used in PHP include or require statements. This improper control can lead to Local File Inclusion (LFI), where an attacker can trick the application into including unintended files from the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service on the affected CozyStay installation. The impact covers confidentiality, integrity, and availability, all rated high. However, there are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor LoftOcean's advisories for updates. Until a fix is available, restricting access to the affected application and limiting exposure to untrusted networks may reduce risk.