CVE-2025-68064 is a Local File Inclusion vulnerability in Everthemess Goya Core before version 1.0.9.4. The issue stems from improper validation of filenames used in PHP include or require statements, allowing an attacker with low privileges to include arbitrary files on the server. This can lead to remote code execution or disclosure of sensitive information. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute arbitrary files. This can result in remote code execution or sensitive data disclosure. The vulnerability requires network access and low privileges but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts.