The vulnerability CVE-2025-68537 affects thembay Zota versions up to 1.3.14 and is caused by improper control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, which can allow an attacker with limited privileges to include and execute unintended files on the server. The CVSS 3.1 base score is 7.5, reflecting high impact with network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive information on the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.