The vulnerability CVE-2025-68539 affects thembay Fana versions up to 1.1.35 and involves improper control over the filename parameter used in PHP include or require statements. This improper control can lead to PHP Local File Inclusion, enabling an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or disclose sensitive information by including local files on the server. This impacts confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor once published.