The vulnerability CVE-2025-68536 affects thembay Zota, a PHP-based product, by allowing improper control over filenames used in include or require statements. This can lead to PHP Local File Inclusion, where an attacker may include unintended files on the server, potentially leading to remote code execution or data disclosure. The affected versions are up to and including 1.3.14. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, leading to remote code execution or unauthorized disclosure of sensitive information. The high CVSS score (8.1) indicates a critical impact on the system's confidentiality, integrity, and availability. There are no known exploits in the wild currently, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP settings, or limiting access to vulnerable endpoints. Monitor vendor channels for updates and apply patches promptly once released.