The vulnerability CVE-2025-68545 affects thembay Nika up to version 1.2.14 and is caused by improper control of filenames in PHP include/require statements, leading to PHP Local File Inclusion. This can allow an attacker to include and execute local files on the server, compromising confidentiality and integrity. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to disclosure of sensitive information and unauthorized code execution on the affected system. The vulnerability does not impact availability but poses a critical risk to confidentiality and integrity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor official thembay channels for updates.