The vulnerability CVE-2025-68530 in pavothemes Bookory arises from improper control over the filename parameter used in PHP include or require statements. This weakness allows PHP Local File Inclusion, potentially enabling an attacker with limited privileges to execute unauthorized code or access sensitive files. The affected versions include all versions up to 2.2.7. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or official remediation details are currently available.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, modification of data, or disruption of service within the affected Bookory installations. Given the high CVSS score and impact metrics, the vulnerability poses a significant risk to affected systems if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable components and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates regarding patches or mitigations.