The vulnerability CVE-2025-68987 involves improper control of the filename parameter in include/require statements within the Edge-Themes Cinerama PHP application. This flaw enables PHP Local File Inclusion, potentially allowing an attacker to include and execute local files on the server. The issue affects all versions up to 2.9. The CVSS 3.1 score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction.

Successful exploitation could lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or disrupt service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Edge-Themes advisories for updates and consider restricting access to vulnerable endpoints as a temporary measure.