The vulnerability CVE-2025-68984 affects the thembay Puca product through improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion vulnerability. This flaw allows an attacker with low privileges to include local files, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all versions up to 2.6.39. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to local file inclusion, which may expose sensitive files, enable code execution, or disrupt service availability. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks or users.