The vulnerability CVE-2025-68536 affects the thembay Zota PHP program through improper control of filenames in include/require statements, leading to PHP Local File Inclusion. This allows attackers to include local files on the server, which can result in arbitrary code execution or information disclosure. The issue impacts versions up to 1.3.14. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service on affected installations of thembay Zota up to version 1.3.14. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions of thembay Zota and apply general PHP hardening practices relevant to file inclusion vulnerabilities. Monitor vendor channels for updates and patches.