The vulnerability CVE-2025-68546 affects thembay Nika versions up to 1.2.14 and involves improper control of the filename parameter in PHP include/require statements. This weakness can lead to PHP Local File Inclusion, where an attacker may cause the application to include unintended files, potentially leading to code execution or information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in full compromise of the affected application, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the potential for severe consequences if exploited.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to vulnerable components and applying any available workarounds recommended by the vendor.