The vulnerability CVE-2025-68539 affects thembay Fana versions up to 1.1.35 and is caused by improper control of filenames in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, which can allow an attacker to include local files on the server, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector with high impact but requiring high attack complexity and no privileges or user interaction.

Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected system due to local file inclusion. This may allow attackers to execute arbitrary code or disclose sensitive information stored on the server. However, no known public exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable include/require functionality or applying other PHP hardening measures specific to file inclusion. Monitor vendor channels for updates and patches.