The vulnerability CVE-2025-69039 in goalthemes Bailly arises from improper validation or control of filenames in PHP include/require statements, enabling local file inclusion attacks. This can allow attackers to read sensitive files or execute arbitrary code depending on the server configuration. The affected versions are up to 1.3.4. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected systems. The high CVSS score indicates a significant risk to affected installations of Bailly prior to version 1.3.5. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor goalthemes advisories for updates. Until a fix is available, avoid exposing vulnerable versions to untrusted networks and consider applying temporary mitigations such as restricting file inclusion paths if possible.