The vulnerability CVE-2025-68985 affects the thembay Aora PHP program through improper validation of filenames used in include or require statements. This flaw enables remote file inclusion, allowing an attacker to execute arbitrary code remotely by including malicious files. The issue affects versions up to and including 1.3.15. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to compromise the affected system's confidentiality, integrity, and availability. This could result in unauthorized access, data theft, data modification, or denial of service. Given the high CVSS score and impact metrics, the vulnerability poses a serious security risk to affected installations of thembay Aora.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from thembay. No vendor advisory or patch links are currently provided, so no official remediation steps can be confirmed at this time.