The vulnerability CVE-2025-68544 affects thembay Diza (up to version 1.3.15) and is characterized by improper control of filenames in PHP include/require statements. This results in a PHP Local File Inclusion vulnerability, which can be exploited to include unintended files on the server. The CVSS 3.1 score is 7.5, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The attacker requires only low privileges and no user interaction, but the attack complexity is high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict input validation and restricting file inclusion paths may help mitigate risk temporarily, but these are not substitutes for an official patch.