The vulnerability CVE-2025-69038 affects goalthemes Hyori through improper control of filenames in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, which may result in arbitrary code execution or information disclosure. The issue affects versions up to and including 1.3.6. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could lead to arbitrary local file inclusion, potentially allowing attackers to execute malicious code, disclose sensitive information, or disrupt service. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor official goalthemes communications for updates.